chore: update GitHub Action pins

[nikzen]

Summary

• Update GitHub Actions in workflows to the latest upstream default-branch commit SHAs.
• Keep existing action paths and only replace refs after @.

Verification

• Checked generated diff to include only .github/**/*.yml / .github/**/*.yaml workflow action refs.
• CI on this PR should validate the updated action versions.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 95.61%. Comparing base (7eec058) to head (1b9c4d4).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #133   +/-   ##
=======================================
  Coverage   95.61%   95.61%           
=======================================
  Files           7        7           
  Lines         798      798           
  Branches      118      118           
=======================================
  Hits          763      763           
  Misses         22       22           
  Partials       13       13           

---

Continue to review full report in Codecov by Sentry.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 7eec058...1b9c4d4. Read the comment docs.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[jason-famedly]

This looks fine.

We need to try and swap out the chartboost/ruff-action for the new built in tooling that does the same thing(this action has not been updated since 2024 and is archived). The migration to a newer codecov action allows using the oidc login method, so that should be adjusted as well