chore: fix update-nodejs-versions workflow

[jbedard]

A robot told me this would fix these issues because:

Two changes:

• actions/setup-node@v2 → v4 (v2 is very old)
• peter-evans/create-pull-request@v3 → v7 — v3 sets the Authorization header directly, which conflicts with actions/checkout@v6's new includeIf-based credential injection,
  causing the "Duplicate header" 400 error

[aspect-workflows]

Bazel 7 (Test)

All tests were cache hits

1 test (100.0%) was fully cached saving 18ms.

---

Bazel 8 (Test)

All tests were cache hits

1 test (100.0%) was fully cached saving 19ms.

---

Bazel 9 (Test)

All tests were cache hits

1 test (100.0%) was fully cached saving 35ms.