Node.js 20 is deprecated warning in GitHub Actions workflows

[piyushsinghgaur1]

Describe the bug

Every GitHub Actions run in this repository is annotated with:

Node.js 20 is deprecated. Please update to a newer version. For more information see: https://github.com/actions/runner/blob/main/docs/node20-deprecation.md

The cause is that our workflows pin JavaScript actions to majors whose action.yml still declares using: node20:

Action	Pin in repo	Files
actions/checkout	@v4	main.yaml, release.yaml, sync-docs.yaml (x2), trivy.yaml
actions/setup-node	@v4	main.yaml, release.yaml

Separately, the Release [Manual] workflow still builds and publishes on node-version: '22', while package.json declares "engines": {"node": "22 || 24"} and the CI matrix already covers Node 24.

To Reproduce

1. Open any recent workflow run in the Actions tab (e.g. the CI workflow on a pull request).
2. Look at the run summary / annotations section.
3. See the "Node.js 20 is deprecated" warning for each step using an affected action.

Expected behavior

Workflow runs complete with no Node.js runtime deprecation annotations, and the release job publishes on a current Node.js LTS.

Additional context

Fix needed:

• Bump actions/checkout from @v4 to @v5 (declares using: node24).
• Bump actions/setup-node from @v4 to @v5 (declares using: node24).
• Bump the release workflow's node-version from '22' to '24', which is within the range already allowed by package.json engines.

Deliberately unchanged:

• The CI matrix node-version: [22, 24] in main.yaml — it already covers Node 24, and dropping 22 would reduce coverage below what engines supports.
• aquasecurity/trivy-action@57a97c7... — SHA-pinned on purpose, and not a node20 JavaScript action, so it is not a source of the annotation. Note that trivy.yaml is affected via its actions/checkout step.

GitHub's runner will eventually stop shipping the Node 20 runtime, at which point these steps fail rather than warn, so this should be addressed before that removal.

This mirrors the same fix applied in sourcefuse/loopback4-microservice-catalog (issue #2601 / PR #2602).