Repair wp/6.6 branch Actions: Update GitHub Actions to their latest versions - #89

Bumps `actions/setup-node` from `v4.0.2` to `v7.0.0`, the latest
published release, across every workflow file that uses it.

Bumps `actions/upload-artifact` from `v4.3.3` to `v7.0.1`, the latest
published release, across every workflow file that uses it.

Bumps `actions/cache` from `v4.0.2` to `v6.1.0`, the latest published
release, across every workflow file that uses it.

Bumps `ramsey/composer-install` from `v3.0.0` to `v4.0.0`, the latest
published release, across every workflow file that uses it.

Bumps `shivammathur/setup-php` from `v2.30.4` to `v2.37.2`, the latest
published release, across every workflow file that uses it.

Bumps `preactjs/compressed-size-action` from `v2.6.0` to `v2.10.0`, the
latest published release, across every workflow file that uses it.

Bumps `actions/download-artifact` from `v4.1.7` to `v8.0.1`, the latest
published release, across every workflow file that uses it.

This also pins the action to a full-length commit SHA in `.github/workflows/end2end-test.yml` where a
version reference was being used incorrectly.

The `mheap/github-action-required-labels` Action is currently referenced with `@v5`, which is not best practice.

This changes the reference to pin the action to the full-length commit SHA for the most recent release, which is currently `v5.6.0`.

Bumps `actions/github-script` from `v7.0.1` to `v9.0.0`, the latest
published release, pinning to a full-length commit SHA per this
branch's action-pinning convention.

A search of the whole `.github/` tree found only one usage, in
`.github/workflows/props-bot.yml`.

Follow-up to this layer's original `actions/checkout` bump. `publish-npm-packages.yml` didn't exist on this branch when that commit was made (it had been removed by the `remove-rn-workflows` layer and was restored afterward), so its three `actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6` calls never got updated. This brings them in line with every other workflow file in this branch, pinning to the same `v7.0.1` release already used elsewhere.

…yml`.

Follow-up to this layer's original `actions/setup-node` bump, for the same reason as the preceding `actions/checkout` follow-up: `publish-npm-packages.yml` didn't exist on this branch when that commit was made and was restored afterward, so its two `actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8 # v4.0.2` calls never got updated. This brings them in line with the rest of the stack, pinning to the same `v7.0.0` release used elsewhere.

Both uses of this sub-action in `end2end-test.yml` were unpinned (`@v4`),
tracking a mutable tag rather than a full-length commit SHA. Pin them to
the current release, `043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` (`v7.0.1`),
so the workflow is not exposed to an upstream tag being moved or a
compromised release.

Move `php-changes-detection.yml`'s pin from `v44.5.1`
(`03334d095e2739fa9ac4034ec16f66d5d01e9eba`) to the current release,
`v47.0.6` (`9426d40962ed5378910ee2e21d5f8c6fcbf2dd96`), so the workflow
picks up the upstream action's fixes and security updates since the
old pin.

This use in `php-changes-detection.yml` was unpinned (`@v3`), tracking a
mutable tag rather than a full-length commit SHA. Pin it to the current
release, `b30e6a3c0ed37e7c023ccd3f1db5c6c0b0c23aad` (`v4.0.0`), so the
workflow is not exposed to an upstream tag being moved or a compromised
release.

zizmor's `ref-version-mismatch` audit (`GITHUB_TOKEN=$(gh auth token) zizmor
--format json .github/workflows/`) found five hash pins whose trailing
`# vX.Y.Z` comment does not match what the pinned commit is actually
tagged as upstream:

- `.github/workflows/bundle-size.yml`: `preactjs/compressed-size-action`
  is tagged `2.10.0` upstream (no `v` prefix), not `v2.10.0`.
- `.github/workflows/unit-test.yml` (two occurrences): `shivammathur/setup-php`'s
  pinned commit is the tip of the `master` branch, not the `v2.37.2` tag.
- `.github/workflows/unit-test.yml` (two occurrences): `ramsey/composer-install`
  is tagged `4.0.0` upstream (no `v` prefix), not `v4.0.0`.

Correcting the comments avoids a misleading version reference next to
each pin. No SHA is changed by this commit -- only comment text.

This applies only the subset of `zizmor --fix=unsafe-only`'s output that
corresponds to these five `ref-version-mismatch` findings specifically;
unrelated "unsafe" fixes zizmor proposed from other audits (e.g.
`persist-credentials: false`, cache `lookup-only: true`, and several
broken/unrelated rewrites) were reviewed and discarded as out of scope
for this change.

The previous commit's zizmor-driven fix corrected this pin's comment to `# master`, since the pinned SHA happened to be the tip of the `master` branch at the time. But the same SHA is also tagged `2.37.2`, and `master` is a moving target — it has, in fact, already advanced past this commit since that fix was made, making the `# master` annotation stale within the same day. Using the stable version tag instead keeps the comment meaningful indefinitely and consistent with every other action pin in this repo.