Update all used GitHub actions

[QuLogic]

Also cleanup a few linting nits.

I also ran zizmor on the repo and it only has one complaint (three times), which are probably okay for now:

$ zizmor --pedantic .
 INFO zizmor: 🌈 zizmor v1.24.1
 INFO audit: zizmor: 🌈 completed ./.github/workflows/wheels.yml
info[template-injection]: code injection via template expansion
   --> ./.github/workflows/wheels.yml:110:29
    |
109 |         run: |
    |         --- this run block
110 |           tar -xvf dist/${{ needs.build_sdist.outputs.SDIST_NAME }}
    |                             ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ may expand into attacker-controllable code
    |
    = note: audit confidence → Low
    = note: this finding has an auto-fix

help[template-injection]: code injection via template expansion
   --> ./.github/workflows/wheels.yml:111:19
    |
109 |         run: |
    |         --- this run block
110 |           tar -xvf dist/${{ needs.build_sdist.outputs.SDIST_NAME }}
111 |           cat ${{ github.workspace }}/tools/wheels/LICENSE_binary.txt >> matplotlib*/LICENSE/LICENSE
    |                   ^^^^^^^^^^^^^^^^ may expand into attacker-controllable code
    |
    = note: audit confidence → High

info[template-injection]: code injection via template expansion
   --> ./.github/workflows/wheels.yml:112:29
    |
109 |         run: |
    |         --- this run block
...
112 |           tar -cvf dist/${{ needs.build_sdist.outputs.SDIST_NAME }} matplotlib* 
    |                             ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ may expand into attacker-controllable code
    |
    = note: audit confidence → Low
    = note: this finding has an auto-fix

3 findings (2 fixable): 2 informational, 1 low, 0 medium, 0 high

[QuLogic]

I've also copied the dependabot config for Actions from the main repo, with a cooldown that is 1 week longer. This should enable us to vet them at least a little bit on the main repo first.

[QuLogic]

Note, cibuildwheel 4 is out now, but I think we should wait on that update since it's a major release with some breaking changes.