Add timeouts to every job and pin actions/checkout to an exact tag

Findings of QC-WF-001 (criteria 8 and 14) applied to the workflows of this
repository and to the two scoped workflows:

- timeout-minutes on every job: quality-checks 15, release 15,
  validate-workflows 10, sync-milestones 15, publish-wiki 10,
  sync-github-metadata 5.
- actions/checkout@v4 becomes actions/checkout@v4.2.2.

No change to inputs, secrets or behaviour. The 6-line run blocks of
sync-milestones.yml move to a script in the framework in a separate change.

.gitea/scoped_workflows/sync-github-metadata.yml

@@ -16,9 +16,10 @@ jobs:
     permissions:
       contents: read
     runs-on: ubuntu-latest
+    timeout-minutes: 5
     steps:
       - name: Fetch the shared script
-        uses: actions/checkout@v4
+        uses: actions/checkout@v4.2.2
         with:
           repository: TirSystem/github-action
           ref: v1