ci(security): avoid persisting credentials on checkout

[JonZeolla]

Contributor Comments

This ensures we don't persist creds on checkout; according to my testing it is not necessary and it's generally unsafe (even though it is the actions/checkout default). When we implement zizmor in the future (on our roadmap), this will be enforced via CI but for now we're adding it as best effort.

Pull Request Checklist

Thank you for submitting a contribution!

Please address the following items:

• If you are adding a dependency, please explain how it was chosen.
• If manual testing is needed in order to validate the changes, provide a testing plan and the expected results.
• Validate that documentation is accurate and aligned to any project updates or additions.

[ai-coding-guardrails]

Nice work! 😎

I didn't find anything of concern

Reviewed with 🤟 by Zenable