Bump actions/create-github-app-token from v1 to v3.1.1 and
EndBug/add-and-commit from v9.1.4 to v10.0.0, both pinned to full commit
SHAs for improved supply chain security.
Fixes#21896
Pin GitHub Actions references to full commit SHAs instead of version
tags to reduce supply chain risk from tag retargeting.
Update actions/checkout to v6.0.2, actions/setup-python to v6.2.0,
actions/setup-node to v6.3.0, actions/stale to v10.2.0, and
dessant/lock-threads to v6.0.0.
