SHA-pin GitHub Actions and upgrade deprecated checkout versions

- Upgrade actions/checkout from v2/v3 to SHA-pinned v4
- SHA-pin all unshelled action tags (pages, CodeQL, scorecard,
  rust-cache, upload/download-artifact, setup-node, cache)
- Standardise scorecard-action to v2.4.0
- Fix setup-node@v6 → SHA-pinned v4

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/release.yml

@@ -33,7 +33,7 @@ jobs:
           #   mix release
 
       # TODO: Upload build artifacts if needed
-      # - uses: actions/upload-artifact@v4
+      # - uses: actions/upload-artifact@ea165f8d65b6db9a8b71b5c2d1a090c0daf9c8bb # v4
       #   with:
       #     name: release-artifacts
       #     path: target/release/
@@ -93,7 +93,7 @@ jobs:
       - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
       # TODO: Download build artifacts if uploading to the release
-      # - uses: actions/download-artifact@v4
+      # - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
       #   with:
       #     name: release-artifacts
       #     path: artifacts/