Node.js 20 is deprecated: bump GitHub Actions to node24 runtimes

[piyushsinghgaur1]

Describe the bug

Workflow runs in this repository emit Node runtime deprecation annotations of the form:

Node.js 20 is deprecated. The following actions target Node.js 20 but are being
forced to run on Node.js 24: actions/setup-node@v4

The cause is that our first-party actions/* pins are on old majors that do not declare using: node24. Verified runtimes of the current pins:

Workflow	Pin	action.yml runtime
.github/workflows/main.yaml:16	actions/checkout@v3	node16
.github/workflows/main.yaml:17	actions/setup-node@v3	node16
.github/workflows/release.yaml:17	actions/checkout@v3	node16
.github/workflows/release.yaml:25	actions/setup-node@v4	node20
.github/workflows/sync-docs.yaml:21,27	actions/checkout@v3 (x2)	node16
.github/workflows/trivy.yaml:22	actions/checkout@v3	node16

None of these run on the runtime they declare — the runner no longer ships Node 16, and Node 20 is on its way out, so each of these steps is force-migrated to a newer Node and annotated accordingly. Per the changelog, runners default to Node 24 from 16 June 2026 and Node 20 is removed from the runner image on 16 September 2026, at which point these become hard failures rather than warnings.

Separately, .github/workflows/release.yaml:27 provisions the release toolchain with node-version: '22'. That is the Node used by our own install/test/publish steps rather than the actions runtime, but it is behind the Node 24 line the CI matrix already covers and should move with this change.

To Reproduce

Steps to reproduce the behavior:

1. Open any recent workflow run in the Actions tab (for example a CI run on a pull request).
2. Open the run summary.
3. Scroll to the Annotations section.
4. See the Node runtime deprecation warning attached to the checkout / setup-node steps.

Expected behavior

Workflow runs complete with no Node runtime deprecation annotations. Every first-party actions/* step resolves to a major whose action.yml declares using: node24.

Fix needed

• Bump actions/checkout@v3 to @v5 (using: node24) in all four workflows.
• Bump actions/setup-node to @v5 (using: node24) in main.yaml (from @v3) and release.yaml (from @v4).
• Bump the release workflow's node-version from '22' to '24'.

Both bumps are drop-in for how these actions are used here: checkout@v5 keeps the fetch-depth, token, repository and path inputs, and setup-node@v5 keeps node-version, registry-url and always-auth. No input changes are required.

Additional context

• The node_matrix_tests matrix in main.yaml is already [22, 24] and should stay as-is — dropping 22 would reduce our supported-version coverage.
• aquasecurity/trivy-action in trivy.yaml is a SHA-pinned third-party action and is out of scope for this change.
• No source or runtime code is affected; the change is confined to .github/workflows/.
• Same remediation as sourcefuse/loopback4-microservice-catalog issue #2601 / PR #2602.
• Reference: Deprecation of Node 20 on GitHub Actions runners