Update GHA uses

[sudo-bmitch]

We have a lot of stale actions. This bumps everything to the latest release.

• actions/checkout v3 -> v4
• actions/setup-go v3 -> v5
• docker/login-action v2 -> v3
• actions/upload-artifact v3 -> v4
• Replace deprecated set-output with $GITHUB_OUTPUT file

Replaces #510

[sudo-bmitch]

See #510 (comment) for details on why we don't want to delay this.

[jdolitsky]

for future update: would be nice to uses hashes for all of them, then dependabot can do these updates for us

[sudo-bmitch]

I'm happy to make that change. Just need to ensure dependabot is setup (it hasn't been updating this file).

[awoimbee]

Yep I don't see a dependabot on this repo, a basic setup would be https://github.com/Trow-Registry/trow/blob/5b794f588ba0e1a6b7d57b6a25f9e6c4724b0b62/.github/dependabot.yml

[sudo-bmitch]

GitHub blog post on the deprecation: https://github.blog/changelog/2024-04-16-deprecation-notice-v3-of-the-artifact-actions/

@opencontainers/distribution-spec-maintainers It appears we have 11 days to merge this and tag a patch release to give users an upgrade option when their CI starts breaking. We could tell users they need to run conformance from main but that would mean they are always running development tests against the development version of the spec. I'm open for other options, or suggestions on how to handle users that want to conform to older versions of the spec that we can implement in the near term. Long term I'd like to redesign conformance, move it to a separate repo that's independently versioned, and pass the spec version as a parameter.