update actions workflows

[meeg]

• GitHub has been complaining for a while now that we're using old versions of their actions, which use out-of-date versions of node.js. These are now updated to the latest versions.
• Our PyPI builds have been failing since sometime January-March (Update papers list with new date and reference #388 worked, Update papers list and last modified date #390 failed) with the message Publishing from a workflow invoked via 'pull_request_target' is not supported.. This must be a policy change, presumably related to recent exploits using pull_request_target (e.g. https://medium.com/@sadi.zane/exploiting-fork-and-pull-request-target-to-compromise-aws-3d3e77873b27). I can't tell where in the stack the policy change actually happened (PyPI in https://docs.pypi.org/trusted-publishers/security-model/ makes the standard warning about pull_request_target being dangerous but doesn't say it's blocked). For what it's worth, I believe our use of pull_request_target is safe since the workflow only runs on code we've reviewed - but if it's blocked, it's blocked. The fix (hopefully) is to trigger the workflow on a push to main branch, and trust that the branch protection rules enforce that this can only happen on PR merge.