Pin deploy workflow actions to commit SHAs

[imorland]

Brings the deploy workflow in line with flarum/framework and flarum/installation-packages, which pin third-party actions to full commit SHAs with the version as a trailing comment.

This also clears the deprecation warning on recent deploy runs — checkout@v4 and setup-node@v4 target Node 20 and were being force-run on Node 24.

Action	Before	After
actions/checkout	@v4	3d3c42e # v7.0.1
actions/setup-node	@v4	8207627 # v7.0.0
appleboy/scp-action	@v1	ff85246 # v1.0.0

The two actions/* SHAs are the exact ones already used across flarum/framework, so the pins stay consistent org-wide. Both are also the current latest release.

Notes

• scp-action is unchanged functionally — v1 and v1.0.0 both already point at ff85246, so this only removes the mutable-tag risk. It's a composite action, so it was never part of the Node 20 deprecation.
• cache: 'yarn' still works. setup-node@v6 limited automatic caching to npm (#1374), but explicit cache input is still fully supported for yarn and pnpm — worth knowing, since this is the one change across v5→v7 that could plausibly have bitten us.
• No other v5→v7 change affects this workflow. checkout@v7's fork-PR restriction applies only to pull_request_target/workflow_run (this triggers on push/workflow_dispatch), and the v5 minimum runner version is satisfied by ubuntu-latest.

Verified each SHA resolves to its claimed tag via the GitHub API, and actionlint passes clean.