ci: move workflow actions off the deprecated Node.js 20 runtime

GitHub is deprecating the Node 20 actions runtime. Bump every action
that runs on (or internally invokes) Node 20 to a Node 24 release:

  - actions/checkout              v4 -> v5
  - actions/deploy-pages          v4 -> v5
  - actions/upload-pages-artifact v3 -> v5  (now pulls upload-artifact v7)

threeal/cmake-action has no Node 24 release yet (only an unreleased main;
upstream issue threeal/cmake-action#883), so replace its three uses with
the equivalent raw cmake invocations already used by the combos/mbedtls
jobs, dropping the dependency entirely.

Left unchanged (not on Node 20): github/codeql-action@v4 (already node24),
codecov/codecov-action@v5.1.2 and ConorMacBride/install-package@v1 (both
pure-shell composite actions with no Node sub-actions).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: Ben Collins <bcollins@libjwt.io>

.github/workflows/build-and-test.yml

diff --git a/.github/workflows/build-and-test.yml b/.github/workflows/build-and-test.yml
index 1f6a027..29f0f2e 100644
--- a/.github/workflows/build-and-test.yml
+++ b/.github/workflows/build-and-test.yml
@@ -26,39 +26,28 @@
   build-macos:
     runs-on: macos-latest
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5
     - uses: ConorMacBride/install-package@v1
       with:
         brew: gnutls openssl@3 jansson pkgconf cmake check curl bats-core jq
 
     - name: Build and Test
-      uses: threeal/cmake-action@v2.1.0
-      with:
-        options:
-          WITH_LIBCURL=YES
-        build-args: |
-          --
-          all
-          check
+      run: |
+        cmake -B build -DWITH_LIBCURL=YES
+        cmake --build build -- all check
 
   build-linux:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5
     - uses: ConorMacBride/install-package@v1
       with:
         apt: gnutls-dev libssl-dev libjansson-dev pkg-config check lcov valgrind libcurl4-openssl-dev bats jq
 
     - name: Build, Test, and Coverage
-      uses: threeal/cmake-action@v2.1.0
-      with:
-        options: |
-          ENABLE_COVERAGE=YES
-          WITH_LIBCURL=YES
-        build-args: |
-          --
-          all
-          check-code-coverage
+      run: |
+        cmake -B build -DENABLE_COVERAGE=YES -DWITH_LIBCURL=YES
+        cmake --build build -- all check-code-coverage
 
     - uses: codecov/codecov-action@v5.1.2
       with:
@@ -92,7 +81,7 @@
           - { name: "GnuTLS+OpenSSL",         flags: "-DWITH_OPENSSL=ON -DWITH_GNUTLS=ON -DWITH_MBEDTLS=OFF" }
           - { name: "MbedTLS+GnuTLS+OpenSSL", flags: "-DWITH_OPENSSL=ON -DWITH_GNUTLS=ON -DWITH_MBEDTLS=ON" }
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5
     - name: Install dependencies
       run: |
         apt-get update
@@ -113,21 +102,15 @@
   build-linux-json-c:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5
     - uses: ConorMacBride/install-package@v1
       with:
         apt: gnutls-dev libssl-dev libjson-c-dev pkg-config check libcurl4-openssl-dev bats jq
 
     - name: Build and Test with json-c
-      uses: threeal/cmake-action@v2.1.0
-      with:
-        options: |
-          WITH_JSON_C=YES
-          WITH_LIBCURL=YES
-        build-args: |
-          --
-          all
-          check
+      run: |
+        cmake -B build -DWITH_JSON_C=YES -DWITH_LIBCURL=YES
+        cmake --build build -- all check
 
   # MbedTLS requires >= 3.6.0, which Ubuntu does not package (it ships 2.28).
   # Debian forky provides mbedtls 3.6.x, so run the MbedTLS matrix in a forky
@@ -138,7 +121,7 @@
     container:
       image: debian:forky
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5
     - name: Install dependencies
       run: |
         apt-get update

.github/workflows/codeql.yml

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 8e85b8f..664424f 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -57,7 +57,7 @@
         # your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@v5
 
     # Add any setup steps before running the `github/codeql-action/init` action.
     # This includes steps like installing compilers or runtimes (`actions/setup-node`

.github/workflows/deploys-docs.yml

diff --git a/.github/workflows/deploys-docs.yml b/.github/workflows/deploys-docs.yml
index a005fc6..0efd021 100644
--- a/.github/workflows/deploys-docs.yml
+++ b/.github/workflows/deploys-docs.yml
@@ -19,7 +19,7 @@
       contents: read
     runs-on: macos-latest
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5
       with:
         fetch-tags: true
         fetch-depth: 0
@@ -50,7 +50,7 @@
 
     - name: Upload pages
       id: deployment
-      uses: actions/upload-pages-artifact@v3
+      uses: actions/upload-pages-artifact@v5
       with:
         path: gh-pages/
 
@@ -67,4 +67,4 @@
     steps:
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@v4
+        uses: actions/deploy-pages@v5