pages: bump to upload-pages-artifact v5 + deploy-pages v5

The v3 pin of upload-pages-artifact internally uses
actions/upload-artifact@v4 as a floating version tag, which trips the
repo's SHA-pinning-required policy and aborts the job. v5.0.0 switches
to actions/upload-artifact@bbbca2dd # v7.0.0 (SHA-pinned) so it
passes the policy.

Bumping deploy-pages to v5 for parity; it has no internal action refs.

Author: jdalton

.github/workflows/pages.yml

@@ -76,7 +76,7 @@ jobs:
           generate walkthrough.json
 
       - name: Upload Pages artifact
-        uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3
+        uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
         with:
           path: walkthrough
 
@@ -93,4 +93,4 @@ jobs:
     steps:
       - name: Deploy
         id: deploy
-        uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4
+        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0