ci: specify persist-credentials for actions/checkout

Explicitly set `persist-credentials: true` for uses of
`actions/checkout` where it's needed (when the job does git operations
using the stored credentials) and `persist-credentials: false` where the
stored credentials are not later used.

This reduces the risk of cached credentials accidentally being leaked
via artifacts.

Signed-off-by: Daniel Hast <hast.daniel@protonmail.com>

.github/workflows/release.yml

@@ -72,6 +72,7 @@ jobs:
       uses: actions/checkout@v6
       with:
         ref: ${{needs.check.outputs.version}}
+        persist-credentials: false
     - name: Set up Go
       uses: actions/setup-go@v6
       with:
@@ -109,6 +110,7 @@ jobs:
       uses: actions/checkout@v6
       with:
         ref: ${{needs.check.outputs.version}}
+        persist-credentials: false
     - name: Set up Go
       uses: actions/setup-go@v6
       with:
@@ -165,6 +167,8 @@ jobs:
         Write-Output "version=$version" | Out-File -FilePath $env:GITHUB_OUTPUT -Append
     - name: Checkout Podman
       uses: actions/checkout@v6
+      with:
+        persist-credentials: false
     - name: Download Windows zip artifact
       uses: actions/download-artifact@v6
     - name: Set up Go
@@ -268,6 +272,7 @@ jobs:
       uses: actions/checkout@v6
       with:
         ref: ${{needs.check.outputs.version}}
+        persist-credentials: false
     - name: Get release notes
       run: |
         ver="$(echo "$VERSION" | sed -e "s/^v//" -e "s/-rc.*//")"