ci: Move remaining Node 20 actions to their Node 24 releases

[krlmlr]

GitHub is retiring the Node 20 action runtime,
so every action we pin needs a release that declares runs.using: node24.

Version numbers are a poor proxy for that,
so the runtime of each pinned action was read from its upstream action.yml.
That turned up the main surprise:
actions/upload-artifact@v5 and actions/download-artifact@v6,
which this repository had already adopted,
are still Node 20 actions.
Their first Node 24 majors are v6 and v7.

Changes

Action	Before	After	Workflows
actions/upload-artifact	v5	v6	revdep2, revdep, R-CMD-check, check, commit, covr
actions/download-artifact	v6	v7	revdep2, commit-suggest
actions/cache, actions/cache/restore	v4	v5	revdep2
actions/checkout	v3 (Node 16)	v6	update-citation-cff
nick-fields/retry	v3.0.2	v4.0.0	pkgdown-deploy

Each action moves to the first Node 24 major rather than the newest tag.
upload-artifact@v7 changes upload semantics
(archive: false, artifact name taken from the uploaded filename),
and download-artifact@v8 turns digest mismatches into hard errors
and stops unzipping based on the Content-Type header.
Neither buys anything here.

The update-citation-cff checkout moves to v6
to match every other workflow in the repository.

Not changed

thollander/actions-comment-pull-request in commit-suggest is Node 20,
and has no Node 24 release yet — even main still declares node20 —
so its pin stays as is.

Everything else already runs on Node 24 or is a composite or Docker action:
actions/checkout@v6, codecov/codecov-action, step-security/harden-runner,
hendrikmuhs/ccache-action, peter-evans/create-pull-request,
krlmlr/lock-threads, posit-dev/setup-air,
and all r-lib/actions and r-hub/actions steps.

Test plan

Every input the workflows pass was checked against the new versions:
overwrite, retention-days, if-no-files-found, compression-level
for upload-artifact;
pattern, run-id, github-token, merge-multiple for download-artifact;
restore-keys for cache;
and timeout_minutes, max_attempts, command for retry.
All are still supported, so no call sites needed adjusting.
CI exercises the artifact, cache, and checkout paths on this PR;
the revdep2 sharding path needs a manual workflow_dispatch run.

LLM disclosure: prepared with Claude Code.

• By submitting this pull request, I assign the copyright of my contribution to The igraph development team.

https://claude.ai/code/session_01Nq9PwEbCX7HT4MqPNUn74X