ci(deps): bump actions/{checkout,setup-node} to @v5 + tighten toml pin

[ohgeeceee]

Closes the remaining open Dependabot security alert on main (actions/setup-node@v4 on release.yml was the leftover after PR #52 landed tauri-action@v1). PRs #1 (setup-node 4→6), #2 (checkout 4→7), and #3 (toml 0.8.2→0.8.23) were all closed-not-merged in the early week of 2026-07-08–10; this replays their content in a single PR with version targets I picked deliberately (@v5 for both actions), not their wild extremes (@v6, @v7).

Changes:

• .github/workflows/release.yml: checkout@v4→@v5, setup-node@v4→@v5
• .github/workflows/{claude,claude-auto-merge,claude-implement-issue, claude-review,codeql}.yml: actions/checkout@v4→@v5 (consistent with build.yml which was already on @v5)

sources already on the right version:

• anthropics/claude-code-action@v1 (recent, not flagged)

• github/codeql-action/{init,analyze}@v4 (current major; v5 is a major rewrite and the existing workflow syntax depends on v4 — left alone)

• tauri-apps/tauri-action@v1 (already merged via PR ci(deps): bump tauri-apps/tauri-action from 0 to 1 #52 on 2026-07-13)

• dtolnay/rust-toolchain@stable, swatinem/rust-cache@v2 — these use the major-version alias, no version bump needed

• src-tauri/Cargo.toml: toml "0.8" → "0.8.23" Cargo.lock already had 0.8.23 (the latest 0.8.x), so this is a defense-in-depth pin: a fresh 'cargo update' can no longer pull a new 0.8.x that reintroduces an issue. Aligns with the Dependabot cargo-minor-patch group intent.

Why @v5 and not @v6/@v7 (Dependabot's PRs went further): @v5 is the version the repo's other workflows (build.yml) have settled on; using the same major across all workflows keeps review diff minimal and matches what's been smoke-tested in CI. If GHSA data later shows @v5 isn't enough, bumping to @v6 is a follow-up PR.

Verification (local Windows):

• pytest backend/ -q -p no:cacheprovider → 144 passed in 49s
• cargo test --lib → 30 passed
• cargo check → clean
• node --test server/dtc/test/*.test.js → 25 passed

No protected-path changes (CLAUDE.md §'Protected paths'):
src-tauri/src/transport/, src-tauri/src/protocol/,
src-tauri/src/commands.rs, bmw_diag/core/** — none touched.

Workflows and Cargo.toml only.

What this adds

For data contributions (community/*.toml)

• Vehicle: chassis + engine + year
• How verified:
• Loads cleanly (checked the Diagnostics tab — no warnings)
• Original / community-derived knowledge, not from ISTA or other
  proprietary software

For code contributions

• cargo fmt and cargo clippy are clean
• Tested against the Simulator (and, if possible, a real car — say which)
• No BMW proprietary data or trademarks added