[dependabot:release-train-updater] Routine CI action pin freshness: license-check.yml lagging behind repo-wide versions

### Control Plane
- Correlation ID: 33867440259-38
- Central repo: githubnext/gh-aw-cao
- Run URL: https://github.com/githubnext/gh-aw-cao/actions/runs/33867440259

## Summary
In `github/gh-aw-threat-detection`, the workflow `.github/workflows/license-check.yml` is the only workflow still pinned to older SHAs for `actions/checkout` (v6.0.2) and `actions/setup-go` (v5.2.0). Every other workflow in the repo (`ci.yml`, `smoke-claude-standalone.lock.yml`, `smoke-codex-standalone.lock.yml`, `smoke-copilot-standalone.lock.yml`) already uses the newer `actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1` and `actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0` pins.

## Why now
Freshness/drift signal — no security advisory involved. Low risk, CI/build-tooling scope only.

## Proposed fix
Bump the two pins in `license-check.yml` to match the rest of the repo. A prepared patch, validation notes, and full PR-ready summary have been published as a review-bundle artifact from this run (bundle: `gh-actions-ci-bump`, workflow run `33867440259`) since this run operates in `review` mode against the control-plane repo, not directly against the target repository.

## Validation performed
- YAML syntax check on the modified file (passed).
- Confirmed both target SHAs against upstream `git ls-remote --tags` for `actions/checkout` and `actions/setup-go` (both map exactly to the claimed release tags).

## Next step
A maintainer with write access to `github/gh-aw-threat-detection` should apply the two-line SHA bump directly (patch available in the review bundle artifact) or dispatch this via a `live`-mode run against that repository.

**Action:** Maintainer of `github/gh-aw-threat-detection` should apply the pin bump in `.github/workflows/license-check.yml` (checkout→v7.0.1, setup-go→v7.0.0) and confirm CI passes.

> Generated by [:dependabot: Dependabot / Release Trains](https://github.com/githubnext/gh-aw-cao/actions/runs/33867904539) · copilot · auto · 72.9 AIC · ⌖ 7.51 AIC · ⊞ 20.5K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Fdependabot-release-train-updater%22&type=issues)
>

_{Add this agentic workflow to your repo}

To install this agentic workflow, run

```
gh aw add githubnext/gh-aw-cao/.github/workflows/dependabot-release-train-updater.md@main
```

> - [x] expires on Sep 18, 2026, 11:39 AM UTC

Open .github/workflows/license-check.yml and compare its actions/checkout and actions/setup-go pins with the versions listed in the issue. Update those two SHA pins, check the workflow YAML syntax, and confirm CI passes; the work is done when the file matches the repo-wide versions and the workflow remains valid.

Written by the indexing model from the issue text.