chore(deps): update remaining GitHub Actions

[TheQmaks]

Summary

• update actions/setup-python from v5 to v7.0.0 in CI and build workflows
• update github/codeql-action from v3 to v4.37.2
• update actions/attest-build-provenance from v3 to v4.1.1
• refresh the pinned CodeQL repository contract

Why

The final Actions audit found Node.js 20 deprecation warnings for setup-python and CodeQL. These updates also clear the remaining stale official Action pin that was outside Dependabot's five-PR weekly limit.

Validation

• targeted repository contract: 1 passed
• full Python suite: 101 passed
• Ruff: passed
• mypy: passed
• JavaScript syntax: passed
• shell syntax: passed
• actionlint v1.7.12: passed

[TheQmaks]

Post-merge verification completed on master commit 22bd4ecd3256f221dfc6a9034bbdeb461eb5677b.

• CI and CodeQL passed on the merge commit, with the previous Node.js 20 / CodeQL v3 deprecation annotations gone.
• The full Weekly Stealth Build passed: native build, SHA/metadata checks, upload-artifact v7, download-artifact v8, attest-build-provenance v4, and release publication.
• Public release: v17.16.3-20260721-run31.1.
• Independent download verification: 4/4 SHA256SUMS entries, 6/6 GitHub asset digests, and 6/6 SLSA attestations verified with the expected repository, signer workflow, refs/heads/master, and source commit.
• The exact public Server and Gadget passed the rooted physical Android 14/API 34 arm64 acceptance harness with stock Frida 17.16.3: process enumeration, spawn/attach/resume, Java hook, procfs marker scans, custom zymbiote socket, Gadget script, and zero-residue cleanup.