CI: bump actions/download-artifact to v4

Originally suggested by github's dependabot this bumps to
download-artifact@v4 for a security issue. That requires bumping to
upload-artifact@v4 too. And that in turn requires that we only have one
tarball with any given name so we no only generate the tarball from the
gcc job.

.github/workflows/build.yml

@@ -53,7 +53,8 @@ jobs:
       - name: move tarball to top level
         run: |
           mv _build/xf86-input-wacom-*tar.bz2 .
-      - uses: actions/upload-artifact@v3
+      - uses: actions/upload-artifact@v4
+        if: ${{ matrix.compiler == 'gcc' }}
         with:
           name: tarball
           path: xf86-input-wacom-*tar.bz2
@@ -84,7 +85,7 @@ jobs:
         env:
           CC: ${{matrix.compiler}}
       # Capture all the meson logs, even if we failed
-      - uses: actions/upload-artifact@v3
+      - uses: actions/upload-artifact@v4
         if: ${{ always() }}  # even if we fail
         with:
           name: meson-test-logs-${{github.job}}-${{matrix.compiler}}-${{matrix.meson_options}}
@@ -107,7 +108,7 @@ jobs:
         with:
           meson_args: -Dauto_features=enabled
       # Capture all the meson logs, even if we failed
-      - uses: actions/upload-artifact@v3
+      - uses: actions/upload-artifact@v4
         if: ${{ always() }}  # even if we fail
         with:
           name: meson-test-logs-${{github.job}}
@@ -130,7 +131,7 @@ jobs:
         with:
           apt: $UBUNTU_PACKAGES
       - name: fetch tarball from previous job(s)
-        uses: actions/download-artifact@v3
+        uses: actions/download-artifact@v4
         with:
           name: tarball
       - name: extract tarball
@@ -160,7 +161,7 @@ jobs:
           apt: $UBUNTU_PACKAGES
           pip: $PIP_PACKAGES
       - name: fetch tarball from previous job(s)
-        uses: actions/download-artifact@v3
+        uses: actions/download-artifact@v4
         with:
           name: tarball
       - name: extract tarball
@@ -175,7 +176,7 @@ jobs:
           meson_args: -Dauto_features=enabled --prefix="$INSTALLDIR"
           ninja_args: test
       # Capture all the meson logs, even if we failed
-      - uses: actions/upload-artifact@v3
+      - uses: actions/upload-artifact@v4
         if: ${{ always() }}  # even if we fail
         with:
           name: tarball-build-meson-test-logs
@@ -192,7 +193,7 @@ jobs:
       - name: Checkout the repo
         uses: actions/checkout@v3
       - name: fetch tarball from previous job(s)
-        uses: actions/download-artifact@v3
+        uses: actions/download-artifact@v4
         with:
           name: tarball
       - name: list git files