Bump GitHub Actions to Node-24-compatible versions

[EtaCassiopeia]

Closes #164.

Migrates every workflow off Node 20-only action versions before:

• 2026-06-02 — Node 24 becomes the runner default
• 2026-09-16 — Node 20 is removed entirely

Version bumps

Action	Before	After	Notes
`actions/checkout`	`@v4`	`@v6`	Node 24 starting v5+
`actions/setup-java`	`@v4`	`@v5`	Node 24 starting v5
`actions/cache`	`@v4`	`@v5`	Node 24 starting v5
`actions/upload-artifact`	`@v4`	`@v7`	Node 24 starting v5+
`actions/configure-pages`	`@v4`	`@v6`	Node 24 starting v5+
`actions/upload-pages-artifact`	`@v3`	`@v5`	Node 24 starting v4+
`actions/deploy-pages`	`@v4`	`@v5`	Node 24 starting v5
`softprops/action-gh-release`	`@v2`	`@v3`	Node 24 starting v3

Three actions don't have a new major yet so they stay where they are:

• `sbt/setup-sbt@v1` (latest `v1.1.23`)
• `scalacenter/sbt-dependency-submission@v3` (latest `v3.2.1`)
• `actions/jekyll-build-pages@v1` (latest `v1.0.13`)

Belt-and-suspenders

Workflow-level `env: FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"` added to all 5 workflows. This forces any remaining Node-20-bundled action to run on Node 24 immediately, ahead of the 2026-06-02 default flip. Once Node 24 becomes the default, the env var is a no-op; keeping it documented ties the change to the deprecation calendar.

Workflows touched

• `.github/workflows/ci.yml` (format + build-matrix + mima + examples)
• `.github/workflows/release.yml` (Maven Central publish + GitHub Release)
• `.github/workflows/docs.yml` (GitHub Pages deploy)
• `.github/workflows/dependency-check.yml` (weekly OWASP scan)
• `.github/workflows/dependency-submission.yml` (Dependabot supply chain)

Verification

This PR's own CI run is the verification — it exercises ci.yml across the same JDK 17/21 × Scala 2.13.16/3.3.4 matrix. release.yml only triggers on `v*` tags, but the action versions there mirror what ci.yml proves.