Bump actions/download-artifact from 4 to 5 (#620)

* Bump actions/download-artifact from 4 to 5

Bumps [actions/download-artifact](https://github.com/actions/download-artifact) from 4 to 5.
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](actions/download-artifact@v4...v5)

---
updated-dependencies:
- dependency-name: actions/download-artifact
  dependency-version: '5'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

* Make dependabot updates happen at quarterly interval

Xref https://docs.github.com/en/code-security/dependabot/working-with-dependabot/dependabot-options-reference#schedule-

* Set explicit write content write permissions on commit-lockfiles job

Fix zizmor `warning[excessive-permissions]: overly broad permissions`. Xref https://docs.zizmor.sh/audits/#excessive-permissions

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Wei Ji <23487320+weiji14@users.noreply.github.com>

Author: dependabot[bot]

.github/dependabot.yml

@@ -8,4 +8,4 @@ updates:
   - package-ecosystem: "github-actions" # See documentation for possible values
     directory: "/" # Location of package manifests
     schedule:
-      interval: "monthly"
+      interval: "quarterly"

.github/workflows/CondaLock.yml

@@ -6,6 +6,8 @@ on:
   repository_dispatch:
     types: [condalock-command]
 
+permissions: {}
+
 jobs:
   condalock:
     strategy:
@@ -60,6 +62,8 @@ jobs:
   commit-lockfiles:
     needs: condalock
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
     steps:
       - name: Checkout Repository
         uses: actions/checkout@v4
@@ -70,7 +74,7 @@ jobs:
           ref: ${{ github.event.client_payload.pull_request.head.ref }}
 
       # Download all artifacts from previous matrix job
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v5
 
       - name: Commit condalock files to PR
         run: |