Update outdated versions used in CI

[soutaro]

Ruby 3.2 reached EOL on 2026-04-01, and several tool versions pinned in the workflows had fallen behind.

The RDoc side of this (the comments.yml Ruby pin and the regenerated core/stdlib comments) was split out into #3035, which is already merged. This PR is rebased on top of it and no longer touches comments.yml.

Ruby versions

• Drop Ruby 3.2 from the ruby.yml test matrix. Ruby 3.2 went EOL on 2026-04-01, and the README already states that the library code targets non-EOL versions of Ruby (>= 3.3 as of 2026). The note in docs/CONTRIBUTING.md that said the CI retains Ruby 3.2 tests is updated to match.
• Run the type check (typecheck.yml) and the Windows compile job (windows.yml) on Ruby 4.0, which the rest of the workflows already use.

required_ruby_version in the gemspec stays at >= 3.2 — this PR only changes what the CI runs.

Tool versions

• LLVM apt repository: jammy → noble. ubuntu-latest is Ubuntu 24.04, so c-check.yml was pulling clang-format packages built for 22.04. Both repositories ship clang-format 20.1.8, so the formatting itself is unaffected. While here, the signing key goes into a keyring instead of the deprecated apt-key, and the source is written to /etc/apt/sources.list.d/ directly — add-apt-repository on 24.04 rejects [signed-by=...] inside a one-line deb shortcut.
• re2c 4.3 → 4.5.1. I built both versions and compared their output for src/lexer.re: after clang-format, the generated src/lexer.c is byte-identical apart from the /* Generated by re2c ... */ banner, so only that line changes here and confirm_lexer stays green.
• wasmtime v45.0.2 → v47.0.2 for the WebAssembly smoke test. wasmtime run --invoke, which rake wasm:check relies on, is still supported.
• JRuby image 10.0.6 → 10.1.1.0 in Dockerfile.jruby.

WASI SDK 33 is still the current release, so it is left alone.

Deliberately not included

• clang-format 20 → 22. Bumping it changes the formatting of the C sources, so it needs a reformatting pass of its own.
• steep/Gemfile still pins steep ~> 1.10 and rbs ~> 3.9 (locked at steep 1.10.0 / rbs 3.10.4) while steep 2.0.0 and rbs 4.0.3 are out. A major steep bump is likely to surface new diagnostics, so it deserves a separate PR.
• actions/cache v5 → v6 — already covered by Bump actions/cache from 5 to 6 #3021, and Pin GitHub Actions to commit hashes #3020 is reworking how actions are pinned, so no action versions are touched here.
• The RUBY_VERSION >= '3.2' guards left in lib/ and test/ are now always true; cleaning them up is a separate change.

🤖 Generated with Claude Code