Set persist-credentials: false on checkout actions.

See https://docs.zizmor.sh/audits/#artipacked.

Compare jspecify/jspecify#861

RELNOTES=n/a
PiperOrigin-RevId: 956568861

Author: cpovirk

.github/workflows/ci.yml

@@ -23,6 +23,8 @@ jobs:
     steps:
       - name: 'Check out repository'
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
       - name: 'Cache Bazel dependencies'
         uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with: