Decide how to handle major version updates of GitHub Actions #665

Part of #607. Follows #616 and #617.

Why

.github/dependabot.yml ignores major versions for the .NET-tied NuGet packages and the .NET
images, but not for GitHub Actions. On its first run Dependabot opened one pull request per major
action update:

• Bump azure/login from 2 to 3 #655 azure/login 2 → 3
• Bump actions/cache from 4 to 6 #656 actions/cache 4 → 6
• Bump actions/checkout from 4 to 7 #657 actions/checkout 4 → 7
• Bump actions/upload-artifact from 4 to 7 #658 actions/upload-artifact 4 → 7
• Bump actions/setup-dotnet from 4 to 6 #659 actions/setup-dotnet 4 → 6

We need to decide whether to keep proposing major action updates, and what to do with these five.

Things to weigh:

• A major action release usually moves to a newer Node.js runtime or drops old inputs. It seldom
  needs a code change, but each one needs reading.
• We are already on two majors at once: review-app-reconcile.yml uses actions/checkout@v7,
  and so do the DfE shared actions, while our other workflows use v4.
• GitHub retires old Node.js runtimes for actions, so staying on old majors stops working
  eventually.
• upload-artifact and cache changes can affect the E2E report and snapshot artefacts, and the
  NuGet cache.

Scope

• Decide: keep major action updates as their own pull requests (recommended, as there are few),
  or add an ignore for version-update:semver-major with the reason, as for NuGet.
• For each of Bump azure/login from 2 to 3 #655–Bump actions/setup-dotnet from 4 to 6 #659, read the release notes, then merge or close with the reason. These are
  official GitHub and verified-publisher actions, which stay on a major tag under the platform
  team's rule (Pin GitHub Actions to commit SHAs and base images to digests #617, #617 Pin third-party actions to commit SHAs and base images to digests #661), so each pull request only changes the major tag.
• Record the decision in docs/dependabot.md ("What is not proposed").

Done when

• Bump azure/login from 2 to 3 #655–Bump actions/setup-dotnet from 4 to 6 #659 are merged or closed with a reason.
• docs/dependabot.md says how major action updates are handled.