publish-npm - Bump actions/- setup-node@v3.6.0 & checkout@v3.5.3 (#4867)

Summary:
This diff bumps `actions/setup-node@v3.6.0` & `actions/checkout@v3.5.3`

### Ref.:
- `actions/checkout@v3.5.3` changelog: https://github.com/actions/checkout/releases/tag/v3.5.3
- `actions/setup-node@v3.6.0` changelog: https://github.com/actions/setup-node/releases/tag/v3.6.0

## Changelog:

[GENERAL] [SECURITY] - [Actions] `publish-npm` - Bump `actions/`- `setup-node@v3.6.0` & `checkout@v3.5.3`

Pull Request resolved: https://github.com/facebook/flipper/pull/4867

Test Plan: - Workflow should run and work as usual.

Reviewed By: lblasa

Differential Revision: D47829480

Pulled By: passy

fbshipit-source-id: f3ca6d0720f9d0774c65eedde5d3a63630588329

.github/workflows/publish-npm.yml

@@ -1,4 +1,5 @@
 name: Publish NPM
+# This action runs on 'git push tag v*'
 on:
   push:
     tags:
@@ -13,8 +14,8 @@ jobs:
   publish:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3.5.3
-      - uses: actions/setup-node@v1
+      - uses: actions/setup-node@v3.6.0
         with:
           node-version: '18.x'
       - name: Install