[improve][ci] Upgrade approved actions and check the ASF allowlist

[lhotari]

Motivation

Keep CI actions on current revisions and detect ASF allowlist problems before they disrupt future builds. This follows the action upgrades in apache/pulsar-client-cpp#610, with the allowlist check included.

Modifications

Add apache/infrastructure-actions/allowlist-check@main immediately after checkout in the main CI workflow. The added step has no if: condition and scans .github/**/*.y*ml, covering both workflow and local composite-action YAML files. It uses the default 30-day non-failing expiration warnings and fails on refs missing from the allowlist.

Upgrade GitHub-owned actions to their latest stable majors and pin third-party actions to the latest revisions in ASF's actions.yml, with version comments:

Action	Previous ref	Updated ref
actions/cache	v3	v6
actions/checkout	v3	v7
actions/setup-node	v3	v7
actions/setup-python	v3	v7
actions/upload-artifact	v4	v7
docker/build-push-action	f9f3042f7e27	v7.4.0 (c3c9e263c25d99ce0380d002d59b67737d91b0dc)
docker/setup-buildx-action	d7f5e7f509e4	v4.4.1 (f87e5991a6d7451dcb8d9637bfbc97413f497069)
docker/setup-qemu-action	06116385d9ba	v4.4.0 (99012661954931238ded8c8b007157a8430204e1)

Verifying this change

• git diff --check passed.
• Parsed all .github YAML files and verified that the new allowlist step has no condition.
• Ran the upstream ASF allowlist checker locally against the current allowlist and expiration metadata: all action refs passed.
• Passed actionlint -shellcheck= -pyflakes= on all workflows.
• CI execution will validate the action upgrades on GitHub-hosted runners; application builds/tests were not run locally for these CI-only changes.

Documentation

• doc-not-needed: CI maintenance only; no public API or runtime dependency changes.