Update github-actions deps (#15359)

This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
|
[actions/create-github-app-token](https://redirect.github.com/actions/create-github-app-token)
| action | minor | `v3.1.1` → `v3.2.0` |
| [actions/stale](https://redirect.github.com/actions/stale) | action |
minor | `v10.2.0` → `v10.3.0` |
|
[docker/setup-buildx-action](https://redirect.github.com/docker/setup-buildx-action)
| action | minor | `v4.0.0` → `v4.1.0` |
|
[github/codeql-action](https://redirect.github.com/github/codeql-action)
| action | minor | `v4.35.5` → `v4.36.0` |

---

> [!WARNING]
> Some dependencies could not be looked up. Check the [Dependency
Dashboard](../issues/8903) for more information.

---

### Release Notes

<details>
<summary>actions/create-github-app-token
(actions/create-github-app-token)</summary>

###
[`v3.2.0`](https://redirect.github.com/actions/create-github-app-token/releases/tag/v3.2.0)

[Compare
Source](https://redirect.github.com/actions/create-github-app-token/compare/v3.1.1...v3.2.0)

##### Features

- add support for enterprise-level GitHub Apps
([#&#8203;263](https://redirect.github.com/actions/create-github-app-token/issues/263))
([952a2a7](https://redirect.github.com/actions/create-github-app-token/commit/952a2a7073df6bfa5f49bc469ec895b6ec1acea4))
- support full repository names in `repositories` input
([#&#8203;372](https://redirect.github.com/actions/create-github-app-token/issues/372))
([85eb8dd](https://redirect.github.com/actions/create-github-app-token/commit/85eb8dd41472213aed25d1a126460e0069138ab6))

##### Bug Fixes

- **deps:** bump
[@&#8203;actions/core](https://redirect.github.com/actions/core) from
3.0.0 to 3.0.1 in the production-dependencies group
([#&#8203;364](https://redirect.github.com/actions/create-github-app-token/issues/364))
([43e5c34](https://redirect.github.com/actions/create-github-app-token/commit/43e5c345bfd4d4f3ecea019ad0042001a09dd857))
- validate private-key input
([#&#8203;376](https://redirect.github.com/actions/create-github-app-token/issues/376))
([f24bbd8](https://redirect.github.com/actions/create-github-app-token/commit/f24bbd89643991c0de27ae823c01791b2c6bafdd))

</details>

<details>
<summary>actions/stale (actions/stale)</summary>

###
[`v10.3.0`](https://redirect.github.com/actions/stale/releases/tag/v10.3.0)

[Compare
Source](https://redirect.github.com/actions/stale/compare/v10.2.0...v10.3.0)

#### What's Changed

##### Bug Fix

- Enhancement: ignore stale labeling events by
[@&#8203;shamoon](https://redirect.github.com/shamoon) in
[#&#8203;1311](https://redirect.github.com/actions/stale/pull/1311)

##### Dependency Updates

- Upgrade dependencies
([@&#8203;actions/core](https://redirect.github.com/actions/core),
[@&#8203;octokit/plugin-retry](https://redirect.github.com/octokit/plugin-retry),
[@&#8203;typescript-eslint](https://redirect.github.com/typescript-eslint))
by [@&#8203;Copilot](https://redirect.github.com/Copilot) in
[#&#8203;1335](https://redirect.github.com/actions/stale/pull/1335)

#### New Contributors

- [@&#8203;shamoon](https://redirect.github.com/shamoon) made their
first contribution in
[#&#8203;1311](https://redirect.github.com/actions/stale/pull/1311)

**Full Changelog**:
<actions/stale@v10...v10.3.0>

</details>

<details>
<summary>docker/setup-buildx-action
(docker/setup-buildx-action)</summary>

###
[`v4.1.0`](https://redirect.github.com/docker/setup-buildx-action/releases/tag/v4.1.0)

[Compare
Source](https://redirect.github.com/docker/setup-buildx-action/compare/v4.0.0...v4.1.0)

- Bump
[@&#8203;docker/actions-toolkit](https://redirect.github.com/docker/actions-toolkit)
from 0.79.0 to 0.90.0 in
[#&#8203;489](https://redirect.github.com/docker/setup-buildx-action/pull/489)
- Bump brace-expansion from 1.1.12 to 5.0.6 in
[#&#8203;547](https://redirect.github.com/docker/setup-buildx-action/pull/547)
[#&#8203;508](https://redirect.github.com/docker/setup-buildx-action/pull/508)
- Bump fast-xml-builder from 1.0.0 to 1.2.0 in
[#&#8203;540](https://redirect.github.com/docker/setup-buildx-action/pull/540)
- Bump fast-xml-parser from 5.4.2 to 5.8.0 in
[#&#8203;496](https://redirect.github.com/docker/setup-buildx-action/pull/496)
- Bump flatted from 3.3.3 to 3.4.2 in
[#&#8203;499](https://redirect.github.com/docker/setup-buildx-action/pull/499)
- Bump glob from 10.3.12 to 13.0.6 in
[#&#8203;495](https://redirect.github.com/docker/setup-buildx-action/pull/495)
- Bump handlebars from 4.7.8 to 4.7.9 in
[#&#8203;504](https://redirect.github.com/docker/setup-buildx-action/pull/504)
- Bump lodash from 4.17.23 to 4.18.1 in
[#&#8203;523](https://redirect.github.com/docker/setup-buildx-action/pull/523)
- Bump picomatch from 4.0.3 to 4.0.4 in
[#&#8203;503](https://redirect.github.com/docker/setup-buildx-action/pull/503)
- Bump postcss from 8.5.6 to 8.5.10 in
[#&#8203;537](https://redirect.github.com/docker/setup-buildx-action/pull/537)
- Bump tar from 6.2.1 to 7.5.15 in
[#&#8203;545](https://redirect.github.com/docker/setup-buildx-action/pull/545)
- Bump undici from 6.23.0 to 6.25.0 in
[#&#8203;492](https://redirect.github.com/docker/setup-buildx-action/pull/492)
- Bump vite from 7.3.1 to 7.3.2 in
[#&#8203;520](https://redirect.github.com/docker/setup-buildx-action/pull/520)

**Full Changelog**:
<docker/setup-buildx-action@v4.0.0...v4.1.0>

</details>

<details>
<summary>github/codeql-action (github/codeql-action)</summary>

###
[`v4.36.0`](https://redirect.github.com/github/codeql-action/releases/tag/v4.36.0)

[Compare
Source](https://redirect.github.com/github/codeql-action/compare/v4.35.5...v4.36.0)

- *Breaking change*: Bump the minimum required CodeQL bundle version to
2.19.4.
[#&#8203;3894](https://redirect.github.com/github/codeql-action/pull/3894)
- Add support for SHA-256 Git object IDs.
[#&#8203;3893](https://redirect.github.com/github/codeql-action/pull/3893)
- Update default CodeQL bundle version to
[2.25.5](https://redirect.github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.5).
[#&#8203;3926](https://redirect.github.com/github/codeql-action/pull/3926)

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - "on tuesday"
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

👻 **Immortal**: This PR will be recreated if closed unmerged. Get
[config
help](https://redirect.github.com/renovatebot/renovate/discussions) if
that's undesired.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/open-telemetry/opentelemetry-collector).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xOTQuMCIsInVwZGF0ZWRJblZlciI6IjQzLjE5NC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiLCJyZW5vdmF0ZWJvdCJdfQ==-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

Author: renovate[bot]

.github/workflows/builder-snapshot.yaml

@@ -44,7 +44,7 @@ jobs:
         with:
           platforms: amd64,arm64,ppc64le,s390x,riscv64
 
-      - uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
+      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
 
       - name: Setup Go
         uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0

.github/workflows/codeql-analysis.yml

@@ -41,12 +41,12 @@ jobs:
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@9e0d7b8d25671d64c341c19c0152d693099fb5ba # v4.35.5
+        uses: github/codeql-action/init@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4.36.0
         with:
           languages: go
 
       - name: Autobuild
-        uses: github/codeql-action/autobuild@9e0d7b8d25671d64c341c19c0152d693099fb5ba # v4.35.5
+        uses: github/codeql-action/autobuild@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4.36.0
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@9e0d7b8d25671d64c341c19c0152d693099fb5ba # v4.35.5
+        uses: github/codeql-action/analyze@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4.36.0

.github/workflows/rerun-workflows.yml

@@ -18,7 +18,7 @@ jobs:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           persist-credentials: false
-      - uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
+      - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
         id: otelbot-token
         with:
           app-id: ${{ vars.OTELBOT_APP_ID }}

.github/workflows/scorecard.yml

@@ -64,6 +64,6 @@ jobs:
 
       # Upload the results to GitHub's code scanning dashboard.
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@9e0d7b8d25671d64c341c19c0152d693099fb5ba # v4.35.5
+        uses: github/codeql-action/upload-sarif@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4.36.0
         with:
           sarif_file: results.sarif

.github/workflows/stale-pr.yaml

@@ -12,7 +12,7 @@ jobs:
       pull-requests: write # for actions/stale to close stale PRs
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/stale@b5d41d4e1d5dceea10e7104786b73624c18a190f # v10.2.0
+      - uses: actions/stale@eb5cf3af3ac0a1aa4c9c45633dd1ae542a27a899 # v10.3.0
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
           stale-pr-message: "This PR was marked stale due to lack of activity. It will be closed in 14 days."