ci: stop persisting checkout credentials in workflows

Set `persist-credentials: false` on every `actions/checkout` so the auto-injected token is not left in `.git/config`, where a later step or uploaded artifact could leak it.

Signed-off-by: Benoit Tigeot <benoit.tigeot@lifen.fr>

.github/workflows/build-test.yml

@@ -19,6 +19,8 @@ jobs:
     steps:
       - name: Checkout source code
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # pin@v7.0.1
+        with:
+          persist-credentials: false
       - name: Add variables to environment file
         run: cat ".github/env" >> "$GITHUB_ENV"
       - name: Setup Go

.github/workflows/codeql-analysis.yml

@@ -45,6 +45,8 @@ jobs:
     steps:
     - name: Checkout repository
       uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # pin@v7.0.1
+      with:
+        persist-credentials: false
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL

.github/workflows/golangci-lint.yml

@@ -14,6 +14,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # pin@v7.0.1
+        with:
+          persist-credentials: false
       - name: Add variables to environment file
         run: cat ".github/env" >> "$GITHUB_ENV"
       - name: Setup Go

.github/workflows/release.yml

@@ -23,6 +23,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # pin@v7.0.1
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Add variables to environment file
         run: cat ".github/env" >> "$GITHUB_ENV"
@@ -88,6 +89,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # pin@v7.0.1
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Add variables to environment file
         run: cat ".github/env" >> "$GITHUB_ENV"