ci: update actions/checkout v6 -> v7

[romanc]

Description

This PR updates actions/checkout from v6 to the latest v7. No breakage is expected from reading the change log.

[tbennun]

@romanc can I ask why? Is there any new feature enabled here or security fix?

[tbennun]

cscs-ci run

[romanc]

@romanc can I ask why? Is there any new feature enabled here or security fix?

This pull request keeps actions/checkout up to date by updating from the v6 to the v7 tag. Tags are rolling within a major release, but major releases need to be updated manually (since they may contain breaking changes).

Compared to v6, v7 will refuse to checkout fork pull request code from a workflow triggered by pull_request_target or workflow_run. This guards against so called "pwn requests" as explained inthis guide. As far as I could see, dace is neither using pull_request_target nor workflow_run. It should thus be safe to update without any hickups. In addition to this new security feature, v7 comes with updated dependencies.