ci: bump actions to node24 runtimes (drop deprecated node20)

[ysyneu]

Why

GitHub is deprecating the node20 action runtime and forcing node24 by 2026-06-16. Our goreleaser + docker-publish (and other) workflow runs already emit the node20 deprecation warning. This bumps every affected action to the latest stable major that ships a node24 runtime.

Verified each action's action.yml using: declaration at the pinned ref (old = node20, new = node24).

Actions bumped (old → new)

Tag-pinned

Action	Old	New
actions/checkout	v4	v5
actions/setup-go	v5	v6
actions/cache	v4	v5
github/codeql-action/* (init, start-proxy, resolve-environment, autobuild, analyze)	v3	v4
golangci/golangci-lint-action	v8	v9
docker/setup-buildx-action (e2e.yml)	v3	v4

SHA-pinned (docker-publish.yml + goreleaser.yml)

Action	Old	New
sigstore/cosign-installer	v3.5.0	v4.1.2
docker/setup-buildx-action	v3.0.0	v4.1.0
docker/login-action	v3.0.0	v4.2.0
docker/metadata-action	v5.0.0	v6.1.0
docker/build-push-action	v5.0.0	v7.2.0
reproducible-containers/buildkit-cache-dance	v2.1.4	v3.4.0
goreleaser/goreleaser-action	(bare SHA = v6.3.0)	v7.2.2 (+ # v7.2.2 comment)

Notes

• buildkit-cache-dance v3: the cache-source input is deprecated in v3 (replaced by cache-map). Migrated to the equivalent cache-map JSON ({"go-build-cache": "/root/.cache/go-build"}) — identical cache behavior, avoids a new deprecation warning.
• docker/build-push-action v7 / metadata-action v6: major bumps are node24 + ESM internals; the only removed surface (DOCKER_BUILD_NO_SUMMARY etc.) and #-comment handling in list inputs are not used here. No config change needed.
• golangci-lint-action v9: pure node24 runtime bump + additive features; version: v2.11 input unchanged.
• Left intentionally: actions/attest-build-provenance@v2 and sigstore/cosign-installer are using: composite (no node runtime) — no node20 concern.

All workflow YAML validated with yaml.safe_load. Only action versions changed; no triggers/jobs/steps logic touched.