Update goreleaser download-artifact action (#45498)

<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #45497

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
not user-facing

## Testing

- [ ] Added/updated automated tests
- [ ] QA'd all new/changed functionality manually

Kinda hard to test outside of a release, but the sibling .msi upload job
works using the same action SHA.



<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Chores**
* Updated pinned GitHub Action digests used in CI to newer commits for
improved security and build reliability.
* Reformatted a CI step parameter across multiple YAML lines (no
functional change) to improve readability and maintainability.

<!-- review_stack_entry_start -->

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45498)

<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

.github/workflows/goreleaser-fleet.yaml

@@ -223,7 +223,7 @@ jobs:
       attestations: write
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
+        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
         with:
           egress-policy: audit
 
@@ -233,7 +233,7 @@ jobs:
           fetch-depth: 0
 
       - name: Download signed fleetctl binary
-        uses: actions/download-artifact@5e317d1137c093c30a278992a91e9db4e3c1f039 # v4.1.8
+        uses: actions/download-artifact@9c19ed7fe5d278cd354c7dfd5d3b88589c7e2395 # v4.1.6
         with:
           name: fleetctl-signed-macos
           path: dist/fleetctl_darwin_all
@@ -296,7 +296,7 @@ jobs:
         uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
 
       - name: Download unsigned fleetctl binary
-        uses: actions/download-artifact@9c19ed7fe5d278cd354c7dfd5d3b88589c7e2395 # v4.1.8
+        uses: actions/download-artifact@9c19ed7fe5d278cd354c7dfd5d3b88589c7e2395 # v4.1.6
         with:
           name: fleetctl-unsigned-windows-${{ matrix.arch }}
 
@@ -379,7 +379,8 @@ jobs:
         continue-on-error: true
         uses: actions/attest-build-provenance@619dbb2e03e0189af0c55118e7d3c5e129e99726 # v2.0
         with:
-          subject-path: dist/fleetctl_v${{ steps.version.outputs.version }}_windows_${{
+          subject-path:
+            dist/fleetctl_v${{ steps.version.outputs.version }}_windows_${{
             matrix.arch }}.msi
 
   upload-fleetctl-msi:
@@ -394,7 +395,7 @@ jobs:
           egress-policy: audit
 
       - name: Download signed MSI artifacts
-        uses: actions/download-artifact@9c19ed7fe5d278cd354c7dfd5d3b88589c7e2395 # v4.1.8
+        uses: actions/download-artifact@9c19ed7fe5d278cd354c7dfd5d3b88589c7e2395 # v4.1.6
         with:
           pattern: fleetctl-msi-*
           merge-multiple: true