Use client-id for app token; upgrade checkout and setup-python to v7

[arcivanov]

actions/create-github-app-token@v3 deprecated the app-id input in favor of client-id, which emits a deprecation warning on both the main and post steps of every release run. This passes release-app-id via client-id instead. The action treats both inputs identically (client-id || app-id, passed as appId to @octokit/auth-app), so existing numeric App IDs supplied via release-app-id continue to work unchanged. The release-app-id input name is kept for compatibility; its description now notes it accepts either the Client ID or the legacy App ID.

Also bumps actions/checkout to v7 (from v6 in action.yml, v5 in the test workflow) and actions/setup-python to v7 (from v6) in both action.yml and the test workflow, with README references updated accordingly. Notable upstream changes:

• checkout v7: ESM migration and dependency bumps; refuses to check out fork PR code under pull_request_target/workflow_run unless allow-unsafe-pr-checkout is set. Callers of this action using those triggers would be affected, since the action performs the checkout for them.
• setup-python v7: ESM migration, manifest fetch retry, stderr warnings classified as warnings; removes the pip-install input, which this action does not use.

All inputs this action passes (persist-credentials, python-version, architecture) remain present in v7.