Fix v4 dependency audit failures

[brunoborges]

Summary

• update @actions/http-client to 3.0.2 and @actions/tool-cache to 2.0.2
• resolve vulnerable transitives with Node 20-compatible overrides and in-range lockfile updates
• rebuild the tracked setup and cleanup bundles

This is a prerequisite for #1187.

Validation

• npm audit --audit-level=high (0 high, 0 critical; 6 moderate remain)
• npm run format-check
• npm run lint
• npm run build
• npm test (562 tests)
• replace retired macos-13 workflow runners with macos-15-intel