Harden and update GitHub Actions workflows

[jonathan343]

Overview

This PR updates GitHub Actions dependencies to their latest versions, hardens workflow security, and tightens the Dependabot update cadence.

Changes

• Update and pin actions to commit SHAs: All actions are upgraded to their latest versions and pinned to exact commit hashes, preventing supply chain attacks via tag mutation:
  • actions/checkout: v2 → v6.0.2
  • actions/setup-python: v6 → v6.2.0
  • actions/setup-node: v6 → v6.4.0
  • aws-actions/stale-issue-cleanup: v4 → v7.1.1
• Add persist-credentials: false: Checkout steps no longer persist Git credentials in the workspace, reducing the blast radius of a compromised step.
• Scope workflow permissions: run-tests.yml now declares permissions: contents: read at the workflow level; stale-issue.yml scopes the job to issues: write only.
• Fix stale-issue cron schedule: Corrected the schedule from */60 * * * * (every hour) to 0 0 * * * (daily).
• Add Dependabot 7-day cooldown: New updates won't be proposed until a dependency has been available for at least 7 days, reducing noise from short-lived or yanked releases.

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.