Update GitHub Actions workflows. (#1636)

This PR was triggered by @t0yv0 generated by the
update-workflows-ecosystem-providers workflow in the pulumi/ci-mgmt
repo, from commit
[691198e3865029b75eb6f6c86b89f9f05fbc083a](pulumi/ci-mgmt@691198e).

## Rebasing this PR

If this PR falls behind `master` on pulumi-cloudflare and needs to be
regenerated against the latest tip, dispatch
[`update-workflows-single-bridged-provider`](https://github.com/pulumi/ci-mgmt/actions/workflows/update-workflows-single-bridged-provider.yml):

```sh
gh workflow run update-workflows-single-bridged-provider.yml \
  --repo pulumi/ci-mgmt \
  -f provider_name=cloudflare \
  -f automerge=false
```

That re-runs this same workflow against current ci-mgmt `master`, closes
this stale PR (via the "obsolete PR" cleanup step above), and opens a
fresh one rebased on the provider's current `master`.

Co-authored-by: Pulumi Bot <bot@pulumi.com>

Author: pulumi-provider-automation[bot]

.github/workflows/publish.yml

@@ -113,7 +113,7 @@ jobs:
     - name: Upload Provider Binaries
       run: aws s3 cp dist s3://get.pulumi.com/releases/plugins/ --recursive
     - name: Create GH Release
-      uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3
+      uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3
       if: inputs.isPrerelease == false
       with:
         tag_name: v${{ inputs.version }}
@@ -165,7 +165,7 @@ jobs:
         # only saving the cache in the prerequisites job
         cache_save: false
     - name: Setup Node
-      uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+      uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
       with:
         # we don't set node-version because we install with mise.
         # this step is needed to setup npm auth