Set persist-credentials: false on checkout actions.

See https://docs.zizmor.sh/audits/#artipacked.

Compare jspecify/jspecify#861

RELNOTES=n/a
PiperOrigin-RevId: 956568861

Author: cpovirk

.github/workflows/ci.yml

@@ -32,6 +32,8 @@ jobs:
     steps:
       - name: 'Check out repository'
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        with:
+          persist-credentials: false
       - name: 'Cache local Maven repository'
         uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
         with:
@@ -59,6 +61,8 @@ jobs:
     steps:
       - name: 'Check out repository'
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        with:
+          persist-credentials: false
       - name: 'Cache local Maven repository'
         uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
         with:
@@ -90,6 +94,8 @@ jobs:
     steps:
       - name: 'Check out repository'
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        with:
+          persist-credentials: false
       - name: 'Cache local Maven repository'
         uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
         with: