[improve][ci] Upgrade approved actions and check the ASF allowlist

[lhotari]

Motivation

Keep CI actions on current revisions and detect ASF allowlist problems before they disrupt future builds. This follows the action upgrades in apache/pulsar-client-cpp#610, with the allowlist check included.

Modifications

Add apache/infrastructure-actions/allowlist-check@main immediately after checkout in the main CI workflow. The added step has no if: condition and scans .github/**/*.y*ml, covering both workflow and local composite-action YAML files. It uses the default 30-day non-failing expiration warnings and fails on refs missing from the allowlist.

Upgrade GitHub-owned actions to their latest stable majors and pin third-party actions to the latest revisions in ASF's actions.yml, with version comments:

Action	Previous ref	Updated ref
actions/setup-java	v5	v6
actions/setup-python	v6	v7
azure/setup-helm	dda3372f752e	v5.0.1 (9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310)

Verifying this change

• git diff --check passed.
• Parsed all .github YAML files and verified that the new allowlist step has no condition.
• Ran the upstream ASF allowlist checker locally against the current allowlist and expiration metadata: all action refs passed.
• Ran actionlint -shellcheck= -pyflakes= on all workflows and compared with the upstream baseline: the same 12 existing expression findings remain, with no new findings.
• CI execution will validate the action upgrades on GitHub-hosted runners; application builds/tests were not run locally for these CI-only changes.

Documentation

• doc-not-needed: CI maintenance only; no public API or runtime dependency changes.