ci(deps): bump the actions-minor-patch group with 2 updates

Bumps the actions-minor-patch group with 2 updates: [CodSpeedHQ/action](https://github.com/codspeedhq/action) and [anchore/sbom-action/download-syft](https://github.com/anchore/sbom-action).


Updates `CodSpeedHQ/action` from 5.2.1 to 5.4.0
- [Release notes](https://github.com/codspeedhq/action/releases)
- [Changelog](https://github.com/CodSpeedHQ/action/blob/main/CHANGELOG.md)
- [Commits](CodSpeedHQ/action@373d686...c4fd08a)

Updates `anchore/sbom-action/download-syft` from 0.24.2 to 0.24.3
- [Release notes](https://github.com/anchore/sbom-action/releases)
- [Changelog](https://github.com/anchore/sbom-action/blob/main/RELEASE.md)
- [Commits](anchore/sbom-action@3ad7283...66cbf4b)

---
updated-dependencies:
- dependency-name: CodSpeedHQ/action
  dependency-version: 5.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions-minor-patch
- dependency-name: anchore/sbom-action/download-syft
  dependency-version: 0.24.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions-minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

Author: dependabot[bot]

.github/workflows/codspeed.yml

@@ -41,7 +41,7 @@ jobs:
           python-version: "3.14"
 
       - name: Run benchmarks under CodSpeed
-        uses: CodSpeedHQ/action@373d6868929f444bc08d901fd0eb0ad52a8875ea # v5.2.1
+        uses: CodSpeedHQ/action@c4fd08a3a159bd0cc208da1e0edf32b8c47d75e5 # v5.4.0
         with:
           mode: simulation
           run: uv run --locked --group benchmark pytest benchmarks/ --codspeed --no-cov

.github/workflows/publish.yml

@@ -60,7 +60,7 @@ jobs:
           SDIST_BUNDLE: ${{ steps.attest-sdist.outputs.bundle-path }}
 
       - name: Install syft
-        uses: anchore/sbom-action/download-syft@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 # v0.24.2
+        uses: anchore/sbom-action/download-syft@66cbf4bc1f1c0d2edc94016e65bc221b6bb0ad6c # v0.24.3
 
       - name: Generate SBOM (CycloneDX)
         run: syft scan dir:dist -o "cyclonedx-json=provenance/assertpy2.sbom.cdx.json"