Set persist-credentials: false on checkout actions.

See https://docs.zizmor.sh/audits/#artipacked.

Compare jspecify/jspecify#861

RELNOTES=n/a
PiperOrigin-RevId: 956550050

Author: cpovirk

.github/workflows/ci.yml

@@ -34,6 +34,8 @@ jobs:
     steps:
       - name: 'Check out repository'
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
       # When we specify multiple JDKs, the final one becomes the default, which is used to execute Maven itself.
       # Our Maven configuration then specifies different JDKs to use for some of the steps:
       # - 11 (sometimes) to *download* to support anyone who runs JDiff or our Gradle integration tests (including our doc snapshots and our Java 11 CI test run) but not to use directly
@@ -64,6 +66,8 @@ jobs:
     steps:
       - name: 'Check out repository'
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
       - name: 'Set up JDKs'
         uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0
         # For the usage of the JDK 11+17, see util/gradle_integration_tests.sh
@@ -89,6 +93,8 @@ jobs:
     steps:
       - name: 'Check out repository'
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
       - name: 'Set up JDKs'
         uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0
         with:
@@ -116,6 +122,8 @@ jobs:
     steps:
       - name: 'Check out repository'
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
       - name: 'Set up JDKs'
         uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0
         with: