ci: bump step-security/harden-runner from 2.12.0 to 2.21.0 - #23

Process completed with exit code 1.

AASTF found 7 vulnerability finding(s) at or above HIGH severity (risk score: 100.0)

Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@v4, actions/setup-python@v5, actions/upload-artifact@v4, github/codeql-action/upload-sarif@v3. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/