ci: pass --use-system-ca to paths-filter under Node 24

Detect changes failed intermittently with a self-signed certificate
error when dorny/paths-filter (node20 action forced onto Node 24)
called the GitHub API. Set NODE_OPTIONS=--use-system-ca on those steps.

Co-authored-by: Rip&Tear <theCyberTech@users.noreply.github.com>

.github/workflows/linter.yml

@@ -15,6 +15,9 @@ jobs:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
       - uses: dorny/paths-filter@d1c1ffe0248fe513906c8e24db8ea791d46f8590 # v3
         id: filter
+        env:
+          # Node 24 (forced for node20 actions) may not trust system CAs by default.
+          NODE_OPTIONS: --use-system-ca
         with:
           # Exclusion-only patterns match every non-excluded file under the
           # default "some" quantifier. Require all patterns (including "**")

.github/workflows/tests.yml

@@ -15,6 +15,9 @@ jobs:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
       - uses: dorny/paths-filter@d1c1ffe0248fe513906c8e24db8ea791d46f8590 # v3
         id: filter
+        env:
+          # Node 24 (forced for node20 actions) may not trust system CAs by default.
+          NODE_OPTIONS: --use-system-ca
         with:
           # Exclusion-only patterns match every non-excluded file under the
           # default "some" quantifier. Require all patterns (including "**")

.github/workflows/type-checker.yml

@@ -15,6 +15,9 @@ jobs:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
       - uses: dorny/paths-filter@d1c1ffe0248fe513906c8e24db8ea791d46f8590 # v3
         id: filter
+        env:
+          # Node 24 (forced for node20 actions) may not trust system CAs by default.
+          NODE_OPTIONS: --use-system-ca
         with:
           # Exclusion-only patterns match every non-excluded file under the
           # default "some" quantifier. Require all patterns (including "**")

.github/workflows/vulnerability-scan.yml

@@ -23,6 +23,9 @@ jobs:
       - uses: dorny/paths-filter@d1c1ffe0248fe513906c8e24db8ea791d46f8590 # v3
         id: filter
         if: github.event_name == 'pull_request'
+        env:
+          # Node 24 (forced for node20 actions) may not trust system CAs by default.
+          NODE_OPTIONS: --use-system-ca
         with:
           # Exclusion-only patterns match every non-excluded file under the
           # default "some" quantifier. Require all patterns (including "**")