ci: use persist-credentials: false throughout

[cpu]

We already do this in most of the other Rustls crates, and Zizmor 0.7.0 flags its absence in this repo. As mentioned in the description of this finding:

By default, using actions/checkout causes a credential to be persisted in the checked-out repo's .git/config, so that subsequent git operations can be authenticated.

Subsequent steps may accidentally publicly persist .git/config, e.g. by including it in a publicly accessible artifact via actions/upload-artifact.

However, even without this, persisting the credential in the .git/config is non-ideal unless actually needed.

We don't need it, so turn it off :-)

[cpu]

Thanks!