[ZEPPELIN-6538] Resolve CI runtime warnings and zeppelin-react audit issues

[voidmatcha]

What is this PR for?

This PR resolves CI/tooling issues tracked in ZEPPELIN-6538.

First, GitHub Actions now warns that Node.js 20 action runtimes are deprecated and are being forced to run on Node.js 24. This PR updates the affected workflow actions in core.yml, frontend.yml, and quick.yml to Node 24 runtime versions.

Second, zeppelin-web-angular/projects/zeppelin-react still reported npm audit findings from the webpack-dev-server@5.x dependency tree. This PR updates webpack-dev-server from 5.2.4 to 6.0.0, which removes the vulnerable sockjs / uuid transitive path and updates the dev-server dependency tree so zeppelin-react full npm audit reports zero vulnerabilities.

It also makes the existing Spark Angular display implicit conversions explicit with scala.language.implicitConversions, avoiding Scala feature warnings in CI without changing the conversion behavior.

What type of PR is it?

Improvement

Todos

• Update GitHub Actions to Node 24 runtime versions
• Update zeppelin-react webpack-dev-server to 6.0.0
• Verify zeppelin-react full npm audit reports zero vulnerabilities
• Make Spark Angular display implicit conversions explicit

What is the Jira issue?

https://issues.apache.org/jira/browse/ZEPPELIN-6538

How should this be tested?

Verified locally:

cd zeppelin-web-angular/projects/zeppelin-react
npm ci --ignore-scripts
npm audit
npm test -- --run
npx webpack --config webpack.config.js --mode development --stats=errors-only

Results:

• npm audit: 0 vulnerabilities
• npm test -- --run: 2 files / 13 tests passed
• webpack development build: exit 0

Also verified:

cd zeppelin-web-angular
npm ci --ignore-scripts
npm run build:react

cd ..
git diff --check
go run github.com/rhysd/actionlint/cmd/actionlint@latest -shellcheck= .github/workflows/core.yml .github/workflows/frontend.yml .github/workflows/quick.yml

Notes:

• Spark compile verification was blocked locally by a linked-worktree git-commit-id-plugin issue before reaching Spark compilation. CI should verify the Spark paths that reported the feature warning.
• Live npm run dev HTTP smoke was not run locally because the local session hook blocks starting dev servers.

Screenshots (if appropriate)

N/A

Questions:

• Does the license files need to update? No.
• Is there breaking changes for older versions? No runtime behavior change is intended. webpack-dev-server@6.0.0 requires Node.js >=22.15.0, and zeppelin-web-angular/.nvmrc already uses Node 22.21.1.
• Does this needs documentation? No.

[ParkGyeongTae]

LGTM. CI is green across the board and the changes are low-risk (CI tooling version bumps, a devDependency-only audit fix, and a warning-suppression-only Scala change with no behavior change). Thanks for verifying locally and documenting the two known local-test gaps in the description.

[ParkGyeongTae]

Merged into master (9489ce8).