chore: update workflow dependencies for Node 24 (#3607)

[arnabnandy7]

What does this PR do?

Updates GitHub Actions dependencies to Node 24-compatible versions, upgrades Codecov to v7, removes duplicate Maven caching, and enables weekly Dependabot updates for Actions.

Preserves existing Java 21 builds, triggers, permissions, and runner images. Workflow lint and whitespace checks passed; full builds were not run.

Fixes #3607. Presubmit’s Node 20 dependency remains unresolved pending an upstream update.

[github-actions]

PR Summary

Updated GitHub Actions dependencies to Node 24-compatible versions, upgraded Codecov to v7, removed duplicate Maven caching, and enabled weekly Dependabot updates for Actions. Preserved Java 21 builds and runner settings; lint passes while full builds aren’t run. Fixes #3607.

Changes

File	Summary
.github/dependabot.yml	Adds a weekly update schedule for GitHub Actions dependencies via Dependabot, while keeping Maven updates weekly. The configuration ensures Node 24 compatibility checks are performed regularly.
.github/workflows/maven-ci.yml	Upgrades workflow actions to v5 (checkout and setup-java), updates Sonar cache to v5, and switches Codecov integration to v7. Removes the explicit local Maven cache step.
.github/workflows/maven-pr-builder.yml	Updates PR builder to newer actions (checkout and setup-java), removes the local Maven cache step, and moves Codecov to v7. Keeps xvfb usage for tests.
.github/workflows/stale.yml	Bumps stale action from v9 to v10 to reflect newer API and features.

---

autogenerated by presubmit.ai

[arnabnandy7]

Both workflows already enable Maven caching through actions/setup-java:

with:
  java-version: '21'
  distribution: 'temurin'
  cache: 'maven'

That caches ~/.m2/repository using a key derived from the Maven dependency files. The separate Cache local Maven repository step cached the same directory under another key, causing duplicate restore/save operations and storage.

Removing it keeps Maven caching enabled through setup-java. The separate Sonar cache remains because it stores different files.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 83.72%. Comparing base (41625d8) to head (2ad50c2).

Additional details and impacted files

@@             Coverage Diff              @@
##             master    #3608      +/-   ##
============================================
- Coverage     83.79%   83.72%   -0.08%     
+ Complexity     4277     4272       -5     
============================================
  Files          1121     1121              
  Lines         15144    15144              
  Branches        723      723              
============================================
- Hits          12690    12679      -11     
- Misses         2159     2167       +8     
- Partials        295      298       +3     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.