Bump actions/setup-node from 3.8.1 to 4.0.2

Bumps [actions/setup-node](https://github.com/actions/setup-node) from 3.8.1 to 4.0.2.
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](actions/setup-node@5e21ff4...60edb5d)

---
updated-dependencies:
- dependency-name: actions/setup-node
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

.github/workflows/draft-github-release.yml

@@ -14,7 +14,7 @@ jobs:
           # We need to fetch the full repository in order to write complete
           # release notes.
           fetch-depth: 0
-      - uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # v3.8.1
+      - uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8 # v4.0.2
         with:
           node-version: current
       - name: Run Release Draft Script

.github/workflows/publish-on-npm.yml

@@ -20,7 +20,7 @@ jobs:
       # Install all deps in preparation for creating a release.
       # Unlike publishing, this is done using the normal NPM registry
       # to download deps.
-      - uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # v3.8.1
+      - uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8 # v4.0.2
         with:
           node-version: current
       # TODO: We should check in a lockfile and use npm ci here instead.
@@ -29,7 +29,7 @@ jobs:
       # Re-setup node using Wombat Dressing Room as the registry
       # The actual NodeJS binaries and such are cached, so doing this
       # twice isn't particularly expensive.
-      - uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # v3.8.1
+      - uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8 # v4.0.2
         with:
           node-version: current
           registry-url: https://wombat-dressing-room.appspot.com