Bump node environment to 16.x

- Bump setup-node action to v2.
- Use composite actions to reuse same setting. This is preferred over
  reusable templates because reusable templates are on job-level but
  setting up node should be a step.

.github/workflows/checks.security.yaml

@@ -16,9 +16,7 @@ jobs:
         uses: actions/checkout@v2
       -
         name: Setup node
-        uses: actions/setup-node@v1
-        with:
-          node-version: 15.x
+        uses: ./.github/actions/setup-node
       -
         name: NPM audit
         run: exit "$(npm audit)" # Since node 15.x, it does not fail with error if we don't explicitly exit