ci: bump actions/cache to v4 and actions/setup-go to v5

[wcchang1115]

Background

Two separate breakages stop the Go test workflow from running.

1. actions/cache@v2 is dead. GitHub shut down the cache service backend for v1/v2. Any run that declares actions/cache@v2 is now failed outright, not just warned — e.g. run 29621107772.

2. actions/setup-go@v2 cannot install Go 1.17/1.18 on macOS. macos-latest is now macos-26-arm64, so setup-go needs a darwin-arm64 build. The actions/go-versions manifest only carries darwin-arm64 from 1.19.10 onward, so 1.17 and 1.18 miss the manifest and fall through to setup-go's direct download path. In v2 that path is hardcoded to storage.googleapis.com/golang, which now returns 403 for every file.

Only the macOS 1.17 and 1.18 jobs hit this — ubuntu finds linux-x64 in the manifest, and macOS 1.19/1.20 find darwin-arm64.

Fix

Change	Effect
actions/cache@v2 → @v4	Uses the live cache service
actions/setup-go@v2 → @v5	Downloads from go.dev/dl instead of the dead bucket

Notes

Decision	Reason
cache v4, not v3	v3's node16 runtime is itself deprecated, so v4 is the durable target
No cache config migration	The step only uses path / key / restore-keys, unchanged from v2 to v4
setup-go v5 without cache: false	v5 turns on its own module cache by default and needs go.sum for the key. In unit-test it runs before checkout, so it logs Restore cache failed: Dependencies file is not found and caches nothing. The error is caught in src/main.ts, so the job is unaffected — the existing actions/cache step still does the caching. Left off to keep the diff to two lines.
actions/checkout@v2 left alone	Node runtime deprecation warning only, not a failure

Verified download URLs:

URL	Status
storage.googleapis.com/golang/go1.17.13.darwin-arm64.tar.gz	403
go.dev/dl/go1.17.13.darwin-arm64.tar.gz	200
go.dev/dl/go1.18.10.darwin-arm64.tar.gz	200

Out of scope

it-test-s3 fails separately with InvalidAccessKeyId: The AWS Access Key Id you provided does not exist in our records. The repo's AWS secrets are invalid or expired. Nothing in this PR affects it; it needs the credentials rotated.