do not persist checkout credentials in GitHub workflows

[firewave]

based on zizmor analysis

[firewave]

Example:

warning[artipacked]: credential persistence through GitHub Actions artifacts
   --> /mnt/s/GitHub/cppcheck-fw/.github/workflows/CI-unixish.yml:178:9
    |
178 |       - uses: actions/checkout@v4
    |         ------------------------- does not set persist-credentials: false
    |
    = note: audit confidence → Low

See actions/checkout#485 for more context.

[firewave]

I filed tickets about addressing the remaining findings:
https://trac.cppcheck.net/ticket/13351
https://trac.cppcheck.net/ticket/13352