Bump actions/checkout to v5 across devops, devops-security and incubator

### Overview

We need to move the remaining six `actions/checkout` pins in `devops`, `devops-security` and `incubator` to `@v5`, and `devops`'s `actions/github-script` to `@v8`, because all of them target Node.js 20 — GitHub has deprecated it and is force-running these on Node 24 today, so the workflows break when that fallback is withdrawn.

This is one decision and one pass across three repos, so it is one issue and three small PRs for one assignee, following the pattern of #174. The bot repo's four pins are already covered by #182 and are not part of this.

### Action Items

**Applies to all three repos: bump to v5, not v6 or v7, even though v7 is current.** v5 is the pure Node 24 bump with no behaviour change. v6 moved the persisted git credential into a separate file, which matters wherever a workflow pushes after checkout — incubator's terraform-docs job does exactly that. v7 additionally blocks fork checkouts for `pull_request_target`/`workflow_run`. Going fully current is a real upgrade needing a real test; keep it a separate decision.

**hackforla/devops** — 1 PR, 2 lines in `.github/workflows/add-update-label-weekly.yml`:

- [ ] Line 11: `actions/checkout@v4` to `@v5`.
- [ ] Line 12: `actions/github-script@v7` to `@v8`. v8 is the Node 24 bump (current is v9). Read the [v7 to v8 migration notes](https://github.com/actions/github-script#v7-to-v8) before assuming it is a version bump: this step's script does `require('./github-actions/trigger-schedule/add-update-label-weekly/add-label.js')`, i.e. it loads a local CommonJS module, which is the part most likely to be affected.
- [ ] **Expect not to be able to verify this one, and say so in the PR.** The workflow is currently `disabled_inactivity` — GitHub disabled it for repository inactivity, the same failure that took the bot down in #180 — and its only trigger is `schedule:` (Sundays 07:00 UTC), with no `workflow_dispatch`, so it cannot be run manually either. `gh api repos/hackforla/devops/actions/workflows/add-update-label-weekly.yml/runs` returns `total_count: 0`.
- [ ] **Do not re-enable it, add a `workflow_dispatch` trigger, or add a keepalive as part of this ticket.** That is separate work of the same shape as #180 and needs its own decision about whether this automation should still run at all. Flag it in the PR and move on.

**hackforla/devops-security** — 1 PR, 2 lines:

- [ ] `terraform-apply.yaml:23` and `terraform-plan.yaml:23`: `actions/checkout@v4` to `@v5`.
- [ ] **Both workflows filter on `paths: '**/*.tf'`, so a PR that only edits `.github/workflows/*.yaml` will not trigger either of them** and the PR will show no checks at all. That is expected, not a failure. To exercise the plan workflow in the same PR, include a no-op change to a `.tf` file (a comment line); otherwise leave it and verify after merge.
- [ ] After the PR merges, confirm the next PR that touches a `.tf` file runs `Write Terraform Plan to Pull Request` successfully with no "Node.js 20 is deprecated" annotation. `terraform-apply.yaml` only runs on push to `main` and performs a real apply, so it is verified by that same merge, not by anything on a branch.

**hackforla/incubator** — 1 PR, 3 lines:

- [ ] `terraform-apply.yaml:31` and `terraform-plan.yaml:31`: `actions/checkout@v4` to `@v5`.
- [ ] `terraform-plan.yaml:55`: `actions/checkout@v3` to `@v5` — this is the terraform-docs job and it is two major versions behind, the furthest behind anything in the org.
- [ ] Unlike devops-security, incubator's path filter includes `**/*.yaml`, so this PR triggers `Terraform plan (OIDC)` on itself. Both of its jobs should run on the PR — use that.
- [ ] **Watch the terraform-docs job specifically.** It checks out `ref: ${{ github.event.pull_request.head.ref }}` and runs `terraform-docs/gh-actions` with `git-push: "true"`, pushing a commit back to the PR branch. It is the only job in any of these repos that writes to git after checkout, so it is the one place a checkout change could plausibly break something. Confirm the push-back still happens.
- [ ] Confirm the `terraform-plan` job still assumes `arn:aws:iam::035866691871:role/incubator-tf-plan` via OIDC and produces a plan.

**All three:**

- [ ] Do not touch third-party actions in this pass, even though several are further behind: `aws-actions/configure-aws-credentials` is on v1 in incubator's `bastion.yml:34` and v3 in its two terraform workflows against v4 in devops-security, `hmarr/debug-action@v1.0.0` has not been released against in years, and `terraform-docs/gh-actions` is pinned at v1.4.1. Each of those is a real upgrade rather than a version bump and deserves its own ticket.
- [ ] After all three PRs merge, re-run the sweep to confirm nothing was missed: `git grep -n "uses: actions/" -- .github/workflows` in each repo should show no `checkout@v3`, no `checkout@v4`, and no `github-script@v7`.

### Resources/Instructions

- Line numbers were accurate 2026-08-24 and may drift — locate each pin by its `uses:` line rather than by position.
- The full inventory this ticket came from, for cross-checking: `devops` `add-update-label-weekly.yml:11,12`; `devops-security` `terraform-apply.yaml:23`, `terraform-plan.yaml:23`; `incubator` `terraform-apply.yaml:31`, `terraform-plan.yaml:31,55`.
- Release notes, for the version reasoning above: [checkout v5.0.0](https://github.com/actions/checkout/releases/tag/v5.0.0), [v6.0.0](https://github.com/actions/checkout/releases/tag/v6.0.0), [v7.0.0](https://github.com/actions/checkout/releases/tag/v7.0.0); [github-script v8.0.0](https://github.com/actions/github-script/releases/tag/v8). Both v5 and v8 require runner v2.327.1 or newer, which GitHub-hosted runners are well past.
- Related: #182, the same bump for the four pins in [hackforla/check-ghpages-versions](https://github.com/hackforla/check-ghpages-versions). Doing that one first is not required, but it is the lowest-risk of the set.
- Related: #180, for what happens when a scheduled workflow is left disabled — the devops workflow above is in that state now.

Start by locating the listed uses: lines in .github/workflows/add-update-label-weekly.yml, terraform-apply.yaml, and terraform-plan.yaml across the three repositories, then read the github-script v7-to-v8 migration notes. Update only the specified action pins, verify incubator's plan and terraform-docs push-back, and use git grep to confirm no targeted old pins remain; note that devops cannot be run and devops-security needs a later Terraform-triggering PR for verification.

Do mô hình lập chỉ mục viết ra từ nội dung của issue.