GH Actions: update for new version of "Create Pull Request"

The "Create Pull Request" action has released a new major version.

I have verified that the workflows as they were would still work.

However, this new version also offers two relevant new features:
* Signing commits.
    The PRs created by this actions are created by the `github-actions[bot]` user. Adding the `sign-commits: true` option will allow the bot to sign the commits based on the repo default `GITHUB_TOKEN`.
* Setting `draft` to `always-true`.
    When changes are made to the "update website" workflow, a draft PR is opened to verify those changes don't negatively impact the workflow. This draft PR should never be merged, it is only for verification.
    Setting the `draft` option to `always-true` not just opens the PR as draft, but will ensure it will stay in draft if the PR would be updated (via the action).

Refs:
* https://github.com/peter-evans/create-pull-request/releases/tag/v7.0.0
* https://github.com/peter-evans/create-pull-request/blob/v7.0.0/docs/concepts-guidelines.md#commit-signature-verification-for-bots

.github/workflows/update-cacert.yml

@@ -91,6 +91,7 @@ jobs:
           base: ${{ steps.branches.outputs.BASE }}
           branch: ${{ steps.branches.outputs.PR_BRANCH }}
           delete-branch: true
+          sign-commits: true
           commit-message: ":lock_with_ink_pen: Update certificate bundle"
           title: ":lock_with_ink_pen: Update certificate bundle"
           body: |

.github/workflows/update-website.yml

@@ -104,7 +104,7 @@ jobs:
             echo "REF=$REF_NAME" >> $GITHUB_OUTPUT
             echo 'PR_TITLE_PREFIX=[TEST | DO NOT MERGE] ' >> $GITHUB_OUTPUT
             echo 'PR_BODY=Test run for the website update after changes to the automated scripts.' >> $GITHUB_OUTPUT
-            echo 'DRAFT=true' >> $GITHUB_OUTPUT
+            echo 'DRAFT=always-true' >> $GITHUB_OUTPUT
           else
             echo "REF=$TAG_NAME" >> $GITHUB_OUTPUT
             echo 'PR_TITLE_PREFIX=' >> $GITHUB_OUTPUT
@@ -170,6 +170,7 @@ jobs:
           base: gh-pages
           branch: feature/auto-ghpages-update-${{ steps.get_pr_info.outputs.REF }}
           delete-branch: true
+          sign-commits: true
           commit-message: "GH Pages: update other docs for Requests ${{ steps.get_pr_info.outputs.REF }}"
           title: "${{ steps.get_pr_info.outputs.PR_TITLE_PREFIX }}:books: Update GHPages website"
           body: |