ci: bump actions/checkout to v7

[hendrikheil]

Part of an org-wide sweep. actions/checkout had drifted to four different major
versions across the org (v3, v4, v5, v6, plus one SHA pin) while the current
release is v7.0.1. This moves every use-site in this repo to v7.

What changed

Every uses: actions/checkout@… under .github/workflows/ and
.github/actions/. Nothing else — no runs-on, no job structure, no other action.

Repos that pin by SHA keep pinning by SHA (the pin is retargeted to v7.0.1's
commit 3d3c42e5 and its trailing version comment updated); repos that pin by tag
keep pinning by tag.

Why this is a separate PR from the runner migration

Deliberately not folded into the ci/hetzner-runners work. A runs-on rollback
is the migration's escape hatch, and it must not silently revert an unrelated
dependency bump. These two changes need independent revert paths.

Why v7 is safe here

The two behaviour changes between the versions in use and v7 were checked against
this org rather than assumed:

• v7 blocks checking out a fork PR head under pull_request_target and
  workflow_run. Surveyed all 65 repos with CI: no repo uses either trigger.
  (An initial grep hit on service-auth was a false positive — the string came
  from a .workflow_runs[] jq filter inside a run: step, not a trigger.)
• v6 moved persisted credentials out of .git/config into a separate file.
  No repo reads or rewrites .git/config credentials; the only related setting
  anywhere is persist-credentials: false in advisor-webapp's renovate
  workflow, which is unaffected.
• v5 raised the minimum runner to v2.327.1. The GARM hetzner-incus runners
  and GitHub-hosted runners are both well past that; several repos in the org
  already run v5 and v6 successfully.

Verification

• The rewrite is a pure version substitution: line counts and surrounding YAML are
  unchanged, verified by diffing actions/checkout@ lines before and after.
• v7.0.1 confirmed as the current release from the GitHub API, not from memory.

Rollback

Revert the commit. Nothing else depends on it.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.