ci: move actions onto the node24 runtime and refresh the test matrix

[dianaKhortiuk-frontegg]

Clears the Node.js 20 is deprecated warning that every job on every PR is currently emitting, and refreshes the test matrix.

The warning

actions/checkout@v4 and actions/setup-node@v4 declare runs.using: node20 in their own action.yml. That runtime is the Node that GitHub uses to execute the action's bundled JavaScript — it has nothing to do with the node-version we ask setup-node to install. Changing the matrix would not have silenced it; only bumping the action major does. v5 declares node24.

wow-actions/use-app-token@v2 in publish.yaml already runs on node24, so it needed no change.

Why v5 and not the latest major

setup-node is on v7 and checkout on v7, but v5 is the first major that fixes this and the changes above it carry risk we gain nothing from:

• setup-node v6 changes automatic cache detection ("Limit automatic caching to npm")
• setup-node v7 migrates to ESM and removes its dummy NODE_AUTH_TOKEN export

Nothing here depends on either — we write .npmrc by hand and never pass registry-url — but publish.yaml only runs on push to master, so it is not exercised by pull-request CI. For an unvalidated release path the smallest sufficient change is the better trade. Moving to v7 later is a fine follow-up, ideally verified against a release.

Test matrix

[18, 20, 21, 22.5.1] → [18, 20, 22, 24]

• drops 21 — EOL June 2024, never an LTS line
• replaces the oddly specific pin 22.5.1 with 22, and adds 24
• keeps 18. It is EOL upstream, but removing it from the matrix would signal that this SDK no longer supports Node 18. That is a support-policy decision, not a CI cleanup, so it is deliberately left for a separate call.

Verified locally before pushing: yarn build and yarn test pass on Node 18.20.8, 22.21.1 and 24.11.1 (171/171 each).

Deliberately not changed

• The pinned Node 18 in _lint.yaml, _pre-release.yaml and publish.yaml. Those are toolchain versions for running eslint and semantic-release, not a support signal, and they work today.
• cache: 'npm' while the repo installs with yarn. setup-node accepts yarn.lock as the hash source so it does not fail, but it caches ~/.npm, which is empty because installs go through yarn — the CI logs show Cache Size: ~0 MB (653 B). Switching it to cache: 'yarn' would make caching actually do something, but it is a behaviour change unrelated to this warning and belongs in its own PR.