VLN-1643: remediate checkout-below-v7 (#841)

> 🏕️ This pull request was created by
[camper](https://github.com/temporalio/camper), an automated security
campaign tool.

## Finding

<table>

<tr><td><strong>Rule</strong></td><td><code>checkout-below-v7</code></td></tr>
  <tr><td><strong>Severity</strong></td><td>MEDIUM</td></tr>

<tr><td><strong>Repository</strong></td><td><code>temporalio/api</code></td></tr>
<tr><td><strong>Ticket</strong></td><td><a
href="https://temporalio.atlassian.net/browse/VLN-1643">VLN-1643</a></td></tr>
</table>

## Summary

- `.github/workflows/ci.yml`: Updated the `actions/checkout` reference
to the required v7.0.0 commit pin.
- `.github/workflows/create-release.yml`: Updated all three
`actions/checkout` references to the required v7.0.0 commit pin.
- `.github/workflows/push-to-buf.yml`: Updated the `actions/checkout`
reference to the required v7.0.0 commit pin.

## Instructions

- **Approve** to merge this fix
- **Request changes** to trigger a new remediation attempt
- `/camper rebase` — rebase onto the base branch
- `/camper close` — close this PR without merging
- `/camper retry` — regenerate the fix from scratch against the current
base

Co-authored-by: picatz <14850816+picatz@users.noreply.github.com>

Author: picatz

.github/workflows/ci.yml

@@ -8,7 +8,7 @@ jobs:
     name: ci
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - uses: actions/setup-go@7b8cf10d4e4a01d4992d18a89f4d7dc5a3e6d6f4 # v4.3.0
         with:
           go-version: '^1.21'

.github/workflows/create-release.yml

@@ -34,15 +34,15 @@ jobs:
       api_go_commit_sha: ${{ steps.pin_commits.outputs.api_go_commit_sha }}
     steps:
       - name: Checkout api
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           ref: ${{ github.event.inputs.branch }}
           fetch-depth: 0
           fetch-tags: true
           path: api
 
       - name: Checkout api-go
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           repository: temporalio/api-go
           ref: ${{ github.event.inputs.branch }}
@@ -114,7 +114,7 @@ jobs:
           owner: ${{ github.repository_owner }}
 
       - name: Checkout
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           ref: ${{ needs.prepare-inputs.outputs.api_commit_sha }}
           token: ${{ steps.generate_token.outputs.token }}

.github/workflows/push-to-buf.yml

@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repo
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - uses: bufbuild/buf-action@fd21066df7214747548607aaa45548ba2b9bc1ff # v1.4.0
         with:
           version: 1.49.0