v1.21 CI workflows still use older action versions than v2.1/v2.4 (for example actions/checkout pinned to v4.4.0 vs v7.0.1, actions/setup-python v5.6.0 vs v7.0.0, github/codeql-action/upload-sarif v3.38.2 vs v4.38.2). This mismatch is currently blocking the automatic merge-up pull request from v1.21 into v2.4 (#1989) with conflicts.

This ticket aligns v1.21 on the versions already used by v2.1/v2.4, and while at it upgrades the remaining actions that are behind their latest major release on all branches (actions/cache v4 to v6, ramsey/composer-install 3.0.0 to 4.0.0). All versions are pinned to their exact release commit SHA with the tag kept in a comment, following the pattern introduced in PHPLIB-1945.

Also backports the merge-up.yml GitHub App checkout pattern (using mongodb-labs/drivers-github-tools/secure-checkout) from v2.1/v2.4 to v1.21, since v1.21 was still on the older token-based checkout.

Follow-up to PHPLIB-1945 (https://jira.mongodb.org/browse/PHPLIB-1945).