bump used actions versions

bump used actions versions
harden security by pinning third-party actions to specific commits to prevent supply chain attacks
add explicit setup-node step before building to enable caching and specify the nodeJS version
replace pnpm with npm
run npm ci instead of npm install to make builds more reproducible
add upload-artifact steps to publish workflows to be able to see exactly which files got uploaded to cloudflare

QuiltMC / quiltmc.org