Update CI and move tox testing matrix to pypy-3.11

[janbrasna]

One of the dependencies (their build/setup stack) is not compatible with pypy-3.10 over PyO3 compatibility. While consumers might want to figure out a way for them to install it on their end, the prudent way to unblock CI here is to move to pypy-3.11 environment at this point.

Resolves #764

This also:

• runs readonly
• bumps checkout action for storing credentials outside of the workdir
• tweaks the "human" version comments so that dependabot will know how to update these as well, not leaving outdated comments around
• migrates action outputs from deprecated syntax to env files
• updates readme badges to current GHA locations (and moves them below the deprecation notice, to make it more visible)

✅ Run logs: https://github.com/janbrasna/bleach/actions/runs/21357508021
👓 Readme preview: https://github.com/mozilla/bleach/tree/08abf7a#readme