bump actions/checkout from 3 to 4; fix pypa/gh-action-pypi-publish warnings

[2bndy5]

• v4 of the actions/checkout uses node.js v20; v3 uses node.js v16. GH deprecated actions that use node.js v16.
• Includes minor fixes to avoid warnings from pypa/gh-action-pypi-publish (follow up to Bump pypa/gh-action-pypi-publish from 1.4.1 to 1.8.11 #316).

[2bndy5]

I don't know why dependabot missed actions/checkout and actions/download-artifact as CI dependencies. I'm hoping it was just an init thing; that sort of thing doesn't usually happen on my other repos that use dependabot.

Lastly, since this PR finishes out the crusade-to-update-CI, I see we're still getting a warning about the setup-graphviz action. I have opened ts-graphviz/setup-graphviz#559, so we might have to revisit that problem in September when GH starts disallowing actions that still use node.js v16.