build(deps): bump the github-action-updates group with 4 updates (#1330)

Bumps the github-action-updates group with 4 updates: [actions/checkout](https://github.com/actions/checkout), [actions/upload-artifact](https://github.com/actions/upload-artifact), [actions/download-artifact](https://github.com/actions/download-artifact) and [github/codeql-action](https://github.com/github/codeql-action).


Updates `actions/checkout` from 4.1.3 to 4.1.4
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@1d96c77...0ad4b8f)

Updates `actions/upload-artifact` from 4.3.1 to 4.3.3
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](actions/upload-artifact@5d5d22a...6546280)

Updates `actions/download-artifact` from 4.1.5 to 4.1.7
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](actions/download-artifact@8caf195...65a9edc)

Updates `github/codeql-action` from 3.25.1 to 3.25.3
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@c7f9125...d39d31e)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-action-updates
- dependency-name: actions/upload-artifact
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-action-updates
- dependency-name: actions/download-artifact
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-action-updates
- dependency-name: github/codeql-action
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-action-updates
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

.github/workflows/ci.yml

@@ -29,7 +29,7 @@ jobs:
  with:
  egress-policy: audit
 
- - uses: actions/checkout@1d96c772d19495a3b5c517cd2bc0cb401ea0529f # v4.1.3
+ - uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
  with:
  ref: ${{ github.event.pull_request.head.sha }}
  - name: Set up Python
@@ -60,7 +60,7 @@ jobs:
  egress-policy: audit
 
  - name: Checkout
- uses: actions/checkout@1d96c772d19495a3b5c517cd2bc0cb401ea0529f # v4.1.3
+ uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
  with:
  ref: ${{ github.event.pull_request.head.sha }}
  - name: Set up Python
@@ -103,7 +103,7 @@ jobs:
  egress-policy: audit
 
  - name: Checkout
- uses: actions/checkout@1d96c772d19495a3b5c517cd2bc0cb401ea0529f # v4.1.3
+ uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
  with:
  ref: ${{ github.event.pull_request.head.sha }}
  - name: Set up Python
@@ -143,7 +143,7 @@ jobs:
  run: 7z a -tzip GTK${{ matrix.gtk-version }}_Gvsbuild_${{ github.sha }}_x64.zip C:\gtk-build\gtk\x64\release\*
  - name: Upload GTK${{ matrix.gtk-version }}_Gvsbuild-${{ github.sha }}_x64.zip
  if: matrix.GTK-version == '4'
- uses: actions/upload-artifact@5d5d22a31266ced268874388b861e4b58bb5c2f3 # v4.3.1
+ uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3
  with:
  name: GTK${{ matrix.gtk-version }}_Gvsbuild_${{ github.sha }}_x64.zip
  path: GTK${{ matrix.gtk-version }}_Gvsbuild_${{ github.sha }}_x64.zip
@@ -158,13 +158,13 @@ jobs:
  if: matrix.gtk-version == '4'
  run: poetry build
  - name: Upload gvsbuild-${{ github.event.release.tag_name }}.tar.gz
- uses: actions/upload-artifact@5d5d22a31266ced268874388b861e4b58bb5c2f3 # v4.3.1
+ uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3
  if: github.event_name == 'release' && matrix.gtk-version == '4'
  with:
  name: gvsbuild-${{ github.event.release.tag_name }}.tar.gz
  path: dist/gvsbuild-${{ github.event.release.tag_name }}.tar.gz
  - name: Upload gvsbuild-${{ github.event.release.tag_name }}-py3-none-any.whl
- uses: actions/upload-artifact@5d5d22a31266ced268874388b861e4b58bb5c2f3 # v4.3.1
+ uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3
  if: github.event_name == 'release' && matrix.gtk-version == '4'
  with:
  name: gvsbuild-${{ github.event.release.tag_name }}-py3-none-any.whl
@@ -178,12 +178,12 @@ jobs:
  if: ${{ github.event_name == 'release' }}
  steps:
  - name: Download tar.gz
- uses: actions/download-artifact@8caf195ad4b1dee92908e23f56eeb0696f1dd42d # v4.1.5
+ uses: actions/download-artifact@65a9edc5881444af0b9093a5e628f2fe47ea3b2e # v4.1.7
  with:
  name: gvsbuild-${{ github.event.release.tag_name }}.tar.gz
  path: dist
  - name: Download wheel
- uses: actions/download-artifact@8caf195ad4b1dee92908e23f56eeb0696f1dd42d # v4.1.5
+ uses: actions/download-artifact@65a9edc5881444af0b9093a5e628f2fe47ea3b2e # v4.1.7
  with:
  name: gvsbuild-${{ github.event.release.tag_name }}-py3-none-any.whl
  path: dist

.github/workflows/codeql.yml

@@ -28,15 +28,15 @@ jobs:
  egress-policy: audit
 
  - name: Checkout repository
- uses: actions/checkout@1d96c772d19495a3b5c517cd2bc0cb401ea0529f # v4.1.3
+ uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
 
  # Initializes the CodeQL tools for scanning.
  - name: Initialize CodeQL
- uses: github/codeql-action/init@c7f9125735019aa87cfc361530512d50ea439c71 # v3.25.1
+ uses: github/codeql-action/init@d39d31e687223d841ef683f52467bd88e9b21c14 # v3.25.3
  with:
  languages: python
 
  - name: Perform CodeQL Analysis
- uses: github/codeql-action/analyze@c7f9125735019aa87cfc361530512d50ea439c71 # v3.25.1
+ uses: github/codeql-action/analyze@d39d31e687223d841ef683f52467bd88e9b21c14 # v3.25.3
  with:
  category: "/language:python"

.github/workflows/dependency-review.yml

@@ -22,6 +22,6 @@ jobs:
  egress-policy: audit
 
  - name: 'Checkout Repository'
- uses: actions/checkout@1d96c772d19495a3b5c517cd2bc0cb401ea0529f # v4.1.3
+ uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
  - name: 'Dependency Review'
  uses: actions/dependency-review-action@5bbc3ba658137598168acb2ab73b21c432dd411b # v4.2.5

.github/workflows/scorecards.yml

@@ -36,7 +36,7 @@ jobs:
  egress-policy: audit
 
  - name: "Checkout code"
- uses: actions/checkout@1d96c772d19495a3b5c517cd2bc0cb401ea0529f # v4.1.3
+ uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
  with:
  persist-credentials: false
 
@@ -63,14 +63,14 @@ jobs:
  # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
  # format to the repository Actions tab.
  - name: "Upload artifact"
- uses: actions/upload-artifact@5d5d22a31266ced268874388b861e4b58bb5c2f3 # v4.3.1
+ uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3
  with:
  name: SARIF file
  path: results.sarif
  retention-days: 5
 
  # Upload the results to GitHub's code scanning dashboard.
  - name: "Upload to code-scanning"
- uses: github/codeql-action/upload-sarif@c7f9125735019aa87cfc361530512d50ea439c71 # v3.25.1
+ uses: github/codeql-action/upload-sarif@d39d31e687223d841ef683f52467bd88e9b21c14 # v3.25.3
  with:
  sarif_file: results.sarif