Merge main into releases/v3

[github-actions]

Merging 01f0019 into releases/v3.

Conductor for this PR is @dbartol.

Contains the following pull requests:

• Mergeback v3.28.4 refs/heads/releases/v3 into main #2716 (@smowton)
• Update default bundle to 2.20.3 #2717 (@dbartol)
• Update workflow permissions #2718 (@kaeluka)

Please do the following:

• Ensure the CHANGELOG displays the correct version and date.
• Ensure the CHANGELOG includes all relevant, user-facing changes since the last release.
• Check that there are not any unexpected commits being merged into the releases/v3 branch.
• Ensure the docs team is aware of any documentation changes that need to be released.
• Mark the PR as ready for review to trigger the full set of PR checks.
• Approve and merge this PR. Make sure Create a merge commit is selected rather than Squash and merge or Rebase and merge.
• Merge the mergeback PR that will automatically be created once this PR is merged.
• Merge all backport PRs to older release branches, that will automatically be created once this PR is merged.

Copilot reviewed 7 out of 7 changed files in this pull request and generated no comments.

Tip: Copilot code review supports C#, Go, Java, JavaScript, Markdown, Python, Ruby and TypeScript, with more languages coming soon. Learn more