Bump the github-actions group with 2 updates

Bumps the github-actions group with 2 updates: [actions/setup-java](https://github.com/actions/setup-java) and [actions/upload-artifact](https://github.com/actions/upload-artifact).

Updates `actions/setup-java` from 4.2.1 to 4.2.2
- [Release notes](https://github.com/actions/setup-java/releases)
- [Commits](actions/setup-java@99b8673...6a0805f)

Updates `actions/upload-artifact` from 4.3.4 to 4.3.5
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](actions/upload-artifact@0b2256b...89ef406)

Fixes #7347

RELNOTES=n/a
PiperOrigin-RevId: 659608173

Author: dependabot[bot]

.github/workflows/ci.yml

@@ -38,7 +38,7 @@ jobs:
       - name: 'Check out repository'
         uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
       - name: 'Set up JDK ${{ matrix.java }}'
-        uses: actions/setup-java@99b8673ff64fbf99d8d325f52d9a5bdedb8483e9 # v4.2.1
+        uses: actions/setup-java@6a0805fcefea3d4657a47ac4c165951e33482018 # v4.2.2
 
         with:
           java-version: ${{ matrix.java }}
@@ -69,7 +69,7 @@ jobs:
       - name: 'Check out repository'
         uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
       - name: 'Set up JDK 21'
-        uses: actions/setup-java@99b8673ff64fbf99d8d325f52d9a5bdedb8483e9 # v4.2.1
+        uses: actions/setup-java@6a0805fcefea3d4657a47ac4c165951e33482018 # v4.2.2
         with:
           java-version: 21
           distribution: 'zulu'
@@ -94,7 +94,7 @@ jobs:
       - name: 'Check out repository'
         uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
       - name: 'Set up JDK 11'
-        uses: actions/setup-java@99b8673ff64fbf99d8d325f52d9a5bdedb8483e9 # v4.2.1
+        uses: actions/setup-java@6a0805fcefea3d4657a47ac4c165951e33482018 # v4.2.2
         with:
           java-version: 11
           distribution: 'zulu'

.github/workflows/scorecard.yml

@@ -59,7 +59,7 @@ jobs:
       # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
       # format to the repository Actions tab.
       - name: "Upload artifact"
-        uses: actions/upload-artifact@0b2256b8c012f0828dc542b3febcab082c67f72b # v4.3.4
+        uses: actions/upload-artifact@89ef406dd8d7e03cfd12d9e0a4a378f454709029 # v4.3.5
         with:
           name: SARIF file
           path: results.sarif