Set persist-credentials: false on checkout actions.

See https://docs.zizmor.sh/audits/#artipacked.

Compare jspecify/jspecify#861

RELNOTES=n/a
PiperOrigin-RevId: 956568861

Author: cpovirk

.github/workflows/ci.yml

@@ -20,6 +20,8 @@ jobs:
     steps:
       - name: 'Check out repository'
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        with:
+          persist-credentials: false
       - name: 'Set up JDK 26 for compilation'
         uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95
         with:
@@ -51,6 +53,8 @@ jobs:
     steps:
       - name: 'Check out repository'
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        with:
+          persist-credentials: false
       - name: 'Set up JDK ${{ matrix.java }} for testing'
         uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95
         with:
@@ -81,6 +85,8 @@ jobs:
     steps:
       - name: 'Check out repository'
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        with:
+          persist-credentials: false
       - name: 'Set up JDK 26'
         uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95
         with:
@@ -106,6 +112,8 @@ jobs:
     steps:
       - name: 'Check out repository'
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        with:
+          persist-credentials: false
       - name: 'Set up JDK 26'
         uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95
         with: