Update GitHub workflow actions and npm tools to latest versions

[glen-84]

Summary

• Bump all SHA-pinned GitHub Actions in the workflows to their latest releases: checkout v6.0.3, setup-dotnet v5.3.0, create-github-app-token v3.2.0, docker login-action v4.2.0, build-push-action v7.2.0, setup-buildx-action v4.1.0, azure artifact-signing-action v2.0.0, and the three nitro-client actions to v16.1.3
• Bump the npm lint tools installed in ci.yml: cspell 10.0.1 and markdownlint-cli2 0.22.1
• Pin comments now record the exact resolved version (e.g. # v6.0.3) instead of just the major
• Both major bumps were verified interface-compatible: the removed setup-buildx install input is not used, and artifact-signing-action v2 keeps an identical input surface

Test plan

• CI on this PR exercises checkout, setup-dotnet, app-token, nitro-client-validate, cspell, and markdownlint-cli2 directly
• The docker, signing, and remaining nitro-client updates run only in the website-publish and release workflows and will be exercised on the next release

[Copilot]

Pull request overview

This PR updates CI/CD automation dependencies by bumping SHA-pinned GitHub Actions across multiple workflows and refreshing a couple of npm-installed lint tools used in CI. This keeps the repository’s build/release/publish pipelines current while preserving supply-chain safety via SHA pinning.

Changes:

• Updated SHA-pinned GitHub Actions to newer releases across release, CI, coverage, benchmarks, and website publish workflows (including checkout, setup-dotnet, create-github-app-token, docker actions, azure artifact signing, and nitro-client actions).
• Bumped npm-installed CI lint tools in ci.yml (cspell to 10.0.1 and markdownlint-cli2 to 0.22.1).
• Updated inline pin comments to record more specific resolved versions for the actions changed in this PR.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
.github/workflows/release.yml	Bumps action pins used in release and Nitro CLI publishing/signing jobs.
.github/workflows/publish-website.yml	Updates checkout + docker action pins used to build/publish the website container.
.github/workflows/publish-website-next.yml	Updates checkout + buildx/login/build-push action pins for the “next” website container flow.
.github/workflows/coverage.yml	Updates checkout/setup-dotnet/docker-login action pins for coverage generation/upload.
.github/workflows/ci.yml	Updates checkout/setup-dotnet/docker-login + nitro-client-validate pins and bumps cspell/markdownlint tool versions.
.github/workflows/ci-cleanup.yml	Updates checkout action pin used for cache cleanup workflow.
.github/workflows/benchmarks.yml	Updates checkout action pin used in benchmark runs and reporting.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.