chore: prepare release v0.31.4

[supertokens-release-ci]

Release v0.31.4

This PR is automatically kept in sync with dev. It will be force-updated on every push to dev.

Review checklist:

• Version 0.31.4 is correct (check setup.py and constants.py)
• Changelog entries below are accurate and complete

After merging: trigger the Release Pipeline with branch 0.31.

---

Fixed

• oauth2provider: use the website base path when building frontend redirect URLs instead of the API base path.
• webauthn: fix sign in failing for counter-incrementing authenticators (e.g. Windows Hello) — the assertion was verified against the core twice

Infrastructure

• Replace the local lint-pr workflow with a thin caller of the shared supertokens/actions reusable lint-pr workflow (behavior unchanged)
• Replace the local dev-sync workflow with a thin caller of the shared supertokens/actions reusable dev-sync workflow (behavior unchanged)
• Mint short-lived GitHub App installation tokens in-job (actions/create-github-app-token) for the release-tag and check-docs workflows, replacing the ALL_REPO_PAT org secret
• Adopt the shared reusable release-tag workflow from supertokens/actions; keep only the docs and PyPI publish jobs as thin callers consuming its outputs. The git tag is now pushed before the API release mark.