build: guard branch-manager against forks and harden checkout (#34006)

Restores if: github.event.repository.fork == false in .github/workflows/assistant-to-the-branch-manager.yml and adds persist-credentials: false to actions/checkout in .github/workflows/google-internal-tests.yml.

Author: josephperrott

.github/workflows/assistant-to-the-branch-manager.yml

@@ -13,7 +13,7 @@ permissions:
 jobs:
   assistant_to_the_branch_manager:
     runs-on: ubuntu-latest
-    if: github.event.pull_request.head.repo.fork == false
+    if: github.event.repository.fork == false
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:

.github/workflows/google-internal-tests.yml

@@ -14,6 +14,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
       - uses: angular/dev-infra/github-actions/google-internal-tests@9ea19241c41afc4579f2bc6983327f6b98ef3025 # main
         with:
           run-tests-guide-url: http://go/angular-material-presubmit