GH Actions: bump actions/download-artifact to v8 (was v5)

Since v7, the action runs on Node.js 24 - see
https://github.com/actions/download-artifact/releases/tag/v7.0.0

[v8](https://github.com/actions/download-artifact/blob/70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3/README.md#v8---whats-new)
will fail if the download hash doesn't match the expected hash and this
is stated as a "breaking" change in
https://github.com/actions/download-artifact/releases/tag/v8.0.0

Personally, I see this as an improvement, not a "breaking change" in the
traditional sense, because it doesn't break anything legitimate that
worked in the previous version.

Author: generalmimon

.github/workflows/release.yml

@@ -46,7 +46,7 @@ jobs:
       id-token: write
     steps:
       - name: Download all the dists
-        uses: actions/download-artifact@v5
+        uses: actions/download-artifact@v8
         with:
           name: python-package-distributions
           path: dist/
@@ -69,7 +69,7 @@ jobs:
       id-token: write  # IMPORTANT: mandatory for trusted publishing
     steps:
       - name: Download all the dists
-        uses: actions/download-artifact@v5
+        uses: actions/download-artifact@v8
         with:
           name: python-package-distributions
           path: dist/