Bump most GitHub Actions 'uses' to their latest tagged releases. (#17705)

Follow-up to https://github.com/iree-org/iree/pull/17703, updating more
actions.

Notably this includes updates to artifacts v4:
https://github.blog/changelog/2023-12-14-github-actions-artifacts-v4-is-now-generally-available/,
which includes substantial performance improvements (e.g. PkgCI "Upload
wheel artifacts" step 26s --> 4s). That is a _breaking change_:
* Artifacts v4 is not cross-compatible with previous versions. For
example, an artifact uploaded using v3 cannot be used with
actions/download-artifact@v4.
diff --git a/.github/workflows/benchmark.yml b/.github/workflows/benchmark.yml
index dc3643f..9b4b6a6 100644
--- a/.github/workflows/benchmark.yml
+++ b/.github/workflows/benchmark.yml
@@ -288,7 +288,7 @@
         run: |
           envsubst < ./.github/workflows/ARTIFACT_SUMMARY_TEMPLATE.md >> "${GITHUB_STEP_SUMMARY}"
       - name: Posting to Discord
-        uses: sarisia/actions-status-discord@61114b793b460ee85fe38ad3fccc78c7ead38d55 # v1.11.1
+        uses: sarisia/actions-status-discord@v1.14.3
         if: failure() && github.ref_name == 'main'
         with:
           webhook: ${{ secrets.DISCORD_WEBHOOK }}
diff --git a/.github/workflows/benchmark_large.yml b/.github/workflows/benchmark_large.yml
index 9b8a0a5..f512c9f 100644
--- a/.github/workflows/benchmark_large.yml
+++ b/.github/workflows/benchmark_large.yml
@@ -11,7 +11,7 @@
 on:
   schedule:
     # Scheduled to run at 09:00 UTC and 21:00 UTC.
-    - cron: '0 09,21 * * *'
+    - cron: "0 09,21 * * *"
   workflow_dispatch:
     inputs:
       shard-count:
@@ -131,7 +131,7 @@
             exit 1
           fi
       - name: Posting to Discord
-        uses: sarisia/actions-status-discord@61114b793b460ee85fe38ad3fccc78c7ead38d55 # v1.11.1
+        uses: sarisia/actions-status-discord@v1.14.3
         if: failure() && github.ref_name == 'main'
         with:
           webhook: ${{ secrets.DISCORD_WEBHOOK }}
diff --git a/.github/workflows/build_package.yml b/.github/workflows/build_package.yml
index d4a4cca..c5efed4 100644
--- a/.github/workflows/build_package.yml
+++ b/.github/workflows/build_package.yml
@@ -122,7 +122,7 @@
         run: ./c/build_tools/python_deploy/install_windows_deps.ps1
       - name: "Configure MSVC (Windows)"
         if: "matrix.build-family == 'windows'"
-        uses: ilammy/msvc-dev-cmd@7315a94840631165970262a99c72cfb48a65d25d # v1.12.0
+        uses: ilammy/msvc-dev-cmd@v1.13.0
 
       ##########################################################################
       # Write version_info.json
@@ -286,7 +286,7 @@
             "${MANYLINUX_X86_64_IMAGE}" \
             bash -c 'export PATH=/opt/python/cp39-cp39/bin:$PATH; python ./c/build_tools/github_actions/build_dist.py py-tf-compiler-tools-pkg'
 
-      - uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # v3.1.2
+      - uses: actions/upload-artifact@v4.3.3
         with:
           # We upload all wheels (which includes deps so that subsequent
           # steps can run without further fetching).
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 4085dee..6239146 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -129,7 +129,7 @@
   #         credentials_json: "${{ secrets.IREE_OSS_GITHUB_RUNNER_BASIC_TRUST_SERVICE_ACCOUNT_KEY }}"
   #         create_credentials_file: false
   #     - name: "Setting up Python"
-  #       uses: actions/setup-python@d27e3f3d7c64b4bbf8e4abfb9b63b83e846e0435 # v4.5.0
+  #       uses: actions/setup-python@v5.1.0
   #       with:
   #         python-version: "3.10" # Needs pybind >= 2.10.1 for Python >= 3.11
   #     - name: "Installing Python packages"
@@ -140,7 +140,7 @@
   #     - name: "Installing requirements"
   #       run: choco install ccache --yes
   #     - name: "Configuring MSVC"
-  #       uses: ilammy/msvc-dev-cmd@7315a94840631165970262a99c72cfb48a65d25d # v1.12.0
+  #       uses: ilammy/msvc-dev-cmd@v1.13.0
   #     # Finally: build and run tests.
   #     - name: "Building IREE"
   #       env:
@@ -218,7 +218,7 @@
           xcrun metal --version
           xcrun metallib --version
       - name: "Setting up Python"
-        uses: actions/setup-python@d27e3f3d7c64b4bbf8e4abfb9b63b83e846e0435 # v4.5.0
+        uses: actions/setup-python@v5.1.0
         with:
           python-version: "3.10"
           cache: "pip"
@@ -511,7 +511,7 @@
 
       - name: "Configuring MSVC"
         if: contains(matrix.name, 'windows')
-        uses: ilammy/msvc-dev-cmd@7315a94840631165970262a99c72cfb48a65d25d # v1.12.0
+        uses: ilammy/msvc-dev-cmd@v1.13.0
 
       # Simple case of no Docker container: install deps -> build -> test.
       - name: "Installing Python requirements"
@@ -559,7 +559,7 @@
         with:
           submodules: true
       - name: "Setting up Python"
-        uses: actions/setup-python@d27e3f3d7c64b4bbf8e4abfb9b63b83e846e0435 # v4.5.0
+        uses: actions/setup-python@v5.1.0
         with:
           python-version: "3.9"
       - name: Wait for docker pull
@@ -953,7 +953,7 @@
             exit 1
           fi
       - name: Posting to Discord
-        uses: sarisia/actions-status-discord@61114b793b460ee85fe38ad3fccc78c7ead38d55 # v1.11.1
+        uses: sarisia/actions-status-discord@v1.14.3
         if: failure() && github.ref_name == 'main'
         with:
           webhook: ${{ secrets.DISCORD_WEBHOOK }}
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 132b2e4..b3501e0 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -18,6 +18,6 @@
       - name: Checking out repository
         uses: actions/checkout@v4.1.7
       - name: Setting up python
-        uses: actions/setup-python@d27e3f3d7c64b4bbf8e4abfb9b63b83e846e0435 # v4.5.0
+        uses: actions/setup-python@v5.1.0
       - name: Running pre-commit
-        uses: pre-commit/action@2c7b3805fd2a0fd8c1884dcaebf91fc102a13ecd # v3.0.1
+        uses: pre-commit/action@v3.0.1
diff --git a/.github/workflows/oneshot_candidate_release.yml b/.github/workflows/oneshot_candidate_release.yml
index bc99036..3629ab9 100644
--- a/.github/workflows/oneshot_candidate_release.yml
+++ b/.github/workflows/oneshot_candidate_release.yml
@@ -26,7 +26,7 @@
           git tag "${tag_name}"
 
       - name: Pushing changes
-        uses: ad-m/github-push-action@40bf560936a8022e68a3c00e7d2abefaf01305a6 # v0.6.0
+        uses: ad-m/github-push-action@v0.8.0
         with:
           github_token: ${{ secrets.WRITE_ACCESS_TOKEN }}
           branch: ${{ github.ref_name }}
diff --git a/.github/workflows/pkgci_build_packages.yml b/.github/workflows/pkgci_build_packages.yml
index 2729c55..a2ceff4 100644
--- a/.github/workflows/pkgci_build_packages.yml
+++ b/.github/workflows/pkgci_build_packages.yml
@@ -71,7 +71,7 @@
           # permissions. Take them back.
           sudo chown -R "$(whoami)" "${cache_dir}"
       - name: Upload wheel artifacts
-        uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # v3.1.2
+        uses: actions/upload-artifact@v4.3.3
         with:
           name: linux_x86_64_release_packages
           path: |
@@ -136,7 +136,7 @@
 #         # permissions. Take them back.
 #         sudo chown -R "$(whoami)" "${cache_dir}"
 #     - name: Upload wheel artifacts
-#       uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # v3.1.2
+#       uses: actions/upload-artifact@v4.3.3
 #       with:
 #         name: linux_x86_64_release_asserts_packages
 #         path: |
diff --git a/.github/workflows/pkgci_regression_test.yml b/.github/workflows/pkgci_regression_test.yml
index 327645b..2d5e021 100644
--- a/.github/workflows/pkgci_regression_test.yml
+++ b/.github/workflows/pkgci_regression_test.yml
@@ -72,11 +72,11 @@
         uses: actions/checkout@v4.1.7
         with:
           submodules: false
-      - uses: actions/setup-python@61a6322f88396a6271a6ee3565807d608ecaddd1 # v4.7.0
+      - uses: actions/setup-python@v5.1.0
         with:
           # Must match the subset of versions built in pkgci_build_packages.
           python-version: "3.11"
-      - uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2
+      - uses: actions/download-artifact@v4.1.7
         with:
           name: linux_x86_64_release_packages
           path: ${{ env.PACKAGE_DOWNLOAD_DIR }}
@@ -120,7 +120,7 @@
           cat ${CONFIG_FILE_PATH}
       - name: "Uploading new config file"
         if: failure()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v4.3.3
         with:
           name: ${{ matrix.config-file }}
           path: ${{ env.CONFIG_FILE_PATH }}
@@ -179,11 +179,11 @@
         uses: actions/checkout@v4.1.7
         with:
           submodules: false
-      - uses: actions/setup-python@61a6322f88396a6271a6ee3565807d608ecaddd1 # v4.7.0
+      - uses: actions/setup-python@v5.1.0
         with:
           # Must match the subset of versions built in pkgci_build_packages.
           python-version: "3.11"
-      - uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2
+      - uses: actions/download-artifact@v4.1.7
         with:
           name: linux_x86_64_release_packages
           path: ${{ env.PACKAGE_DOWNLOAD_DIR }}
diff --git a/.github/workflows/pkgci_test_tensorflow_cpu.yml b/.github/workflows/pkgci_test_tensorflow_cpu.yml
index 9a050a6..09cfea6 100644
--- a/.github/workflows/pkgci_test_tensorflow_cpu.yml
+++ b/.github/workflows/pkgci_test_tensorflow_cpu.yml
@@ -31,11 +31,11 @@
         uses: actions/checkout@v4.1.7
         with:
           submodules: false
-      - uses: actions/setup-python@61a6322f88396a6271a6ee3565807d608ecaddd1 # v4.7.0
+      - uses: actions/setup-python@v5.1.0
         with:
           # Must match the subset of versions built in pkgci_build_packages.
           python-version: "3.11"
-      - uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2
+      - uses: actions/download-artifact@v4.1.7
         with:
           name: linux_x86_64_release_packages
           path: ${{ env.PACKAGE_DOWNLOAD_DIR }}
diff --git a/.github/workflows/publish_website.yml b/.github/workflows/publish_website.yml
index 9999f86..adcdd5c 100644
--- a/.github/workflows/publish_website.yml
+++ b/.github/workflows/publish_website.yml
@@ -40,7 +40,7 @@
         # We have to explicitly fetch the gh-pages branch as well to preserve history
         run: git fetch --no-tags --prune --depth=1 origin "gh-pages:gh-pages"
       - name: Setting up Python
-        uses: actions/setup-python@d27e3f3d7c64b4bbf8e4abfb9b63b83e846e0435 # v4.5.0
+        uses: actions/setup-python@v5.1.0
         with:
           python-version: 3.x
           cache: "pip"
diff --git a/.github/workflows/samples.yml b/.github/workflows/samples.yml
index 1e68667..0fbb34b 100644
--- a/.github/workflows/samples.yml
+++ b/.github/workflows/samples.yml
@@ -33,7 +33,7 @@
       - name: "Checking out repository"
         uses: actions/checkout@v4.1.7
       - name: "Setting up Python"
-        uses: actions/setup-python@61a6322f88396a6271a6ee3565807d608ecaddd1 # v4.7.0
+        uses: actions/setup-python@v5.1.0
         with:
           python-version: "3.11"
       - name: "Testing Colab Notebooks"
@@ -53,7 +53,7 @@
           export CC=clang
           export CXX=clang++
       - name: "Setting up Python"
-        uses: actions/setup-python@61a6322f88396a6271a6ee3565807d608ecaddd1 # v4.7.0
+        uses: actions/setup-python@v5.1.0
         with:
           python-version: "3.11"
       - name: "Testing Samples"
diff --git a/.github/workflows/validate_and_publish_release.yml b/.github/workflows/validate_and_publish_release.yml
index 578ef4a..be1b933 100644
--- a/.github/workflows/validate_and_publish_release.yml
+++ b/.github/workflows/validate_and_publish_release.yml
@@ -35,7 +35,7 @@
           ls -R
       - name: Set up python
         id: set_up_python
-        uses: actions/setup-python@d27e3f3d7c64b4bbf8e4abfb9b63b83e846e0435 # v4.5.0
+        uses: actions/setup-python@v5.1.0
         with:
           python-version: "3.9"
       - name: Install python packages
@@ -128,7 +128,7 @@
           fetch-depth: 0
 
       - name: Updating latest-snapshot branch
-        uses: ad-m/github-push-action@40bf560936a8022e68a3c00e7d2abefaf01305a6 # v0.6.0
+        uses: ad-m/github-push-action@v0.8.0
         with:
           github_token: ${{ secrets.WRITE_ACCESS_TOKEN }}
           branch: latest-snapshot