[dependabot:release-train-updater] Review bundle: bump actions/checkout and actions/setup-go pins

A dependency review bundle was prepared for `github/gh-aw-threat-detection` (review mode — no live PR was opened there).

### What
- Bump `actions/checkout` pinned SHA from v6.0.2 (`de0fac2...83dd`) to v7.0.1 (`3d3c42e...90b1`) in `.github/workflows/ci.yml`, `gh-aw-version-check.yml`, `license-check.yml`, `release-platform-parity.yml`.
- Bump `actions/setup-go` pinned SHA from v5.2.0 (`3041bf5...8122a`) to v7.0.0 (`b7ad1da...4303e`) in `license-check.yml`.
- Both target versions are already used elsewhere in the same repo's other workflows, so this only removes drift — no untested versions introduced.

### Why
- CI-only tooling drift found while scanning `github/gh-aw-threat-detection` (Go module, no other manifest ecosystems present besides Actions).
- No existing `.github/dependabot.yml` or open Dependabot PR covers this.

### Risk
Low — CI/build tooling only, no runtime/application code, no auth/crypto/telemetry surface touched. Confidence: high. `Smart-Dependabot-Merge-Candidate: yes` (still requires human merge).

### Review artifact
Full patch, summary, and validation notes were published as a workflow artifact (bundle `actions-bump`) via `publish_review_bundle`, since `safe_output_mode` for this run is `review` and the target repo is `github/gh-aw-threat-detection` (not this control repo). A human should apply the patch directly to `github/gh-aw-threat-detection` and open the PR there, or re-run this worker in `live` mode against that repo.

### Control Plane
- Correlation ID: 33873310314-39
- Central repo: githubnext/gh-aw-cao
- Run URL: https://github.com/githubnext/gh-aw-cao/actions/runs/33873310314

**Action:** Maintainer of `github/gh-aw-threat-detection`: download the `actions-bump` review artifact from this run, apply `changes.patch`, and open a PR. Acceptance check: CI passes on the 4 modified workflows.

> Generated by [:dependabot: Dependabot / Release Trains](https://github.com/githubnext/gh-aw-cao/actions/runs/33873714451) · copilot · auto · 59.7 AIC · ⌖ 8.51 AIC · ⊞ 20.5K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Fdependabot-release-train-updater%22&type=issues)
>

_{Add this agentic workflow to your repo}

To install this agentic workflow, run

```
gh aw add githubnext/gh-aw-cao/.github/workflows/dependabot-release-train-updater.md@main
```

> - [x] expires on Sep 18, 2026, 12:44 PM UTC

Download the `actions-bump` review artifact from the referenced run and inspect `changes.patch`. Apply the listed pin updates in `.github/workflows/ci.yml`, `gh-aw-version-check.yml`, `license-check.yml`, and `release-platform-parity.yml`, then verify that CI passes on all four modified workflows.

Written by the indexing model from the issue text.