chore(ci): Bump the actions group with 5 updates

.github/workflows/audit.yml

@@ -53,7 +53,7 @@ jobs:
         with:
           persist-credentials: false
 
-      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
         with:
           python-version: '3.14'
 
@@ -85,7 +85,7 @@ jobs:
       # Uploaded whatever the verdict says, so a finding reaches the Security tab on the run that
       # found it, and an empty report closes the alerts a fix made obsolete.
       - name: Report to code scanning
-        uses: github/codeql-action/upload-sarif@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0
+        uses: github/codeql-action/upload-sarif@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
         with:
           sarif_file: ${{ runner.temp }}/osv.sarif
           category: osv-scanner

.github/workflows/ci.yml

@@ -58,7 +58,7 @@ jobs:
       - name: Add the 32-bit target
         run: rustup target add i686-pc-windows-msvc
 
-      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+      - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
 
       # Cheapest gate first: a whitespace slip should not wait out a four-minute Rust build.
       - name: C# format
@@ -257,7 +257,7 @@ jobs:
       - name: Add the 32-bit target
         run: rustup target add i686-pc-windows-msvc
 
-      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+      - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
 
       # Both cores and the window, packaged the way a release packages them. The gates are skipped on purpose:
       # clippy, the tests and the format check are the Gates job's, and running them twice would only slow

.github/workflows/codeql.yml

@@ -66,13 +66,13 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Initialise CodeQL
-        uses: github/codeql-action/init@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0
+        uses: github/codeql-action/init@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
         with:
           languages: ${{ matrix.language }}
           build-mode: none
           queries: security-extended
 
       - name: Analyse
-        uses: github/codeql-action/analyze@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0
+        uses: github/codeql-action/analyze@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
         with:
           category: /language:${{ matrix.language }}

.github/workflows/distribution.yml

@@ -30,7 +30,7 @@ jobs:
       - name: Add the 32-bit target
         run: rustup target add i686-pc-windows-msvc
 
-      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+      - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
 
       # The script's own gate calls `cargo deny`, so the binary has to be resolvable as a cargo subcommand.
       - name: Put cargo-deny on PATH

.github/workflows/mutation.yml

@@ -110,7 +110,7 @@ jobs:
       # One cache for all the parts, written only by the weekly run on main, read by every run. The
       # parts leave the workspace crates built from mutations, which the action leaves out of what it
       # saves - only the dependencies are kept.
-      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+      - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
         with:
           shared-key: mutation
           save-if: ${{ github.event_name != 'pull_request' && github.ref == 'refs/heads/main' }}

.github/workflows/pages.yml

@@ -62,7 +62,7 @@ jobs:
       # Rust comes preinstalled on the runner, exactly as in ci.yml. The generator is a
       # small crate and depends only on chrono-ctl, which has no dependencies of its
       # own and touches no Windows API - which is why this builds on Linux at all.
-      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+      - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
 
       # --strict: a dead internal link fails the build rather than being published.
       # GitHub Pages cannot issue redirects, so a wrong address stays wrong until a

.github/workflows/release.yml

@@ -130,7 +130,7 @@ jobs:
       - name: Add the 32-bit target
         run: rustup target add i686-pc-windows-msvc
 
-      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+      - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
 
       - name: Put cargo-deny on PATH
         shell: pwsh

.github/workflows/search.yml

@@ -117,7 +117,7 @@ jobs:
         with:
           persist-credentials: false
 
-      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+      - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
         with:
           shared-key: search
           save-if: ${{ github.event_name != 'pull_request' && github.ref == 'refs/heads/main' }}

.github/workflows/security.yml

@@ -35,7 +35,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
         with:
           python-version: '3.14'
 
@@ -86,7 +86,7 @@ jobs:
           comment-summary-in-pr: never
           fail-on-severity: low
 
-      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
         with:
           python-version: '3.14'
 
@@ -125,7 +125,7 @@ jobs:
           fetch-depth: 2
           persist-credentials: false
 
-      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
         with:
           python-version: '3.14'