Workflows: Update Version Numbers and use Commit SHA for Github Actions

## MENTOR
- @natalialuzuriaga @sachin-panayil
- Software Engineers, CMS OSPO, DSACMS repository management
- #dsac-ospo on Slack

## BRIEF DESCRIPTION

Our GitHub Action workflows across all our repositories in DSACMS organization are due for an audit and version updates. Use the [updateStringInRepos workflow](https://github.com/DSACMS/repo-scaffolder/blob/main/.github/actions.md#updating-files) and [addFilesToRepos](https://github.com/DSACMS/repo-scaffolder/blob/main/.github/actions.md#adding-files) in repo-scaffolder to:
- Use the latest up-to-date versions of actions/checkout, Node, Python, and other GH Action dependencies
- Switch from version number to SHA commit hash for all our GitHub Actions to bolster security

## SCOPING
1 week

## SKILLS NEEDED
CI/CD, GitHub Actions

## REQUIRED DELIVERABLES
Make as clear of a step-by-step list as you can

**Verifying that workflows works correctly**
We would like to use the [updateStringInRepos workflow](https://github.com/DSACMS/repo-scaffolder/blob/main/.github/actions.md#updating-files) and [addFilesToRepos](https://github.com/DSACMS/repo-scaffolder/blob/main/.github/actions.md#adding-files) to do this work.
1. In a separate GitHub organization, add the workflow and test within the organization to verify functionality. @natalialuzuriaga has her own test organization (https://github.com/natalialuzuriaga-testing-org) she can provide you access where you can set this up and test.
2. If there are any bugs, work with the mentors to fix them. We are also very open to ideas to make the workflow more useful to do this specific rotation as well as other use cases -- please propose them to the mentors!

**Tackling common workflow files in all repositories**
1. Browse all DSACMS repositories. Located in the `.github` directories, identify common workflow files across all repositories that require version updates / need to use SHA commit hashes.
2. For each workflow file, identify which GH action dependencies need to be updated to use the latest version and its corresponding commit hash. Make the code change using the SHA commit hash and include a comment with the respective version number. Perform testing to verify that the version update does not cause breaking changes to the workflow.
3. Review with mentors to finalize approach with a PR. Once approved, use the updateStringInRepos OR addFilesToRepos workflow to make the update across the organization.
4. Repeat for all common workflow files

Here is a list that could serve as a starting point for all common workflow files:
https://github.com/DSACMS/repo-scaffolder/blob/main/docs/.github-directory.md

**Tackling repositories that use custom-made workflows specific to that repository**
1. Browse all DSACMS repositories. Identify repositories that use custom workflows.
2. For each workflow file, identify which GH action dependencies need to be updated to use the latest version and its corresponding commit hash. Perform testing to verify that the version update does not cause breaking changes to the workflow
3. Since this workflow file is specific to the repository, no need to use the updateStringInRepos workflow. Simply create a PR with the change and add mentors for PR review.

**Tackling repositories that are GitHub Actions**
1. Browse all DSACMS repos for OSPO GitHub Actions repositories. As of writing this ticket, archival-identifier, repo-sunsetter, automated-codejson-generator, and super-changelog(?) should be the shipped actions.
2. Review the repository contents and identify dependencies that need updating. Follow step 2 from above.
3. Create a PR with the change and add the repository maintainer for PR review

## DESIRED DELIVERY WINDOW
- Any

## NOTES/INSPO
Has some overlap with https://github.com/DSACMS/repo-scaffolder/issues/392, I would suggest doing https://github.com/DSACMS/repo-scaffolder/issues/392 first then tackling this one.

Great beginner friendly ticket to learn GitHub Actions, CI/CD, and Devops!

As you are doing this work, you may find that the workflows may have bugs or could be refactored to better automate this task, we are very open to ideas and improvements!

Importance of pinning actions by commit SHA:
https://blog.rafaelgss.dev/why-you-should-pin-actions-by-commit-hash

From GitHub on updating Node.js actions:
> Node.js 20 actions are deprecated. The following actions are running on Node.js 20 and may not work as expected: actions/checkout@v4, actions/setup-go@v5. Actions will be forced to run with Node.js 24 by default starting June 2nd, 2026. Node.js 20 will be removed from the runner on September 16th, 2026. Please check if updated versions of these actions are available that support Node.js 24. To opt into Node.js 24 now, set the FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true environment variable on the runner or in your workflow file. Once Node.js 24 becomes the default, you can temporarily opt out by setting ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/

# ACKNOWLEDGEMENTS
- [X] - Yes, I agree to spend file a project proposal ticket
- [X] - Yes, I agree this project falls within a 2 week or less (ideally less) scope of time
- [X] - Yes, I agree to spend an hour per week of office hours and 1x1 mentoring
- [X] - Yes, I agree to spend an hour at the end of the sprint for filling out a Retro Template