actions/checkout v4 -> v7, actions/setup-node v4 -> v7 and
pnpm/action-setup v4 -> v6.
Also bumps the two pins in .github/actions/setup-workspace, which
dependabot's github-actions updater never proposed: `directory: /`
scans .github/workflows only, so a composite action's own `uses:`
lines are invisible to it. Left alone they would have kept the repo
on setup-node v4 in every lane that goes through the composite —
which is every lane except the checkout steps themselves.
Nayan
24215ecbf9