ci: Do not persist credentials after checkout

.github/workflows/sync-common-workflows.yaml

@@ -45,6 +45,8 @@ jobs:
       - uses: actions/checkout@v4
         with:
           path: workflows
+          persist-credentials: false
+
       - name: Sync Workflows
         run: |
           git config --global user.email "shaka-bot@users.noreply.github.com"

.github/workflows/sync-labels.yaml

@@ -26,6 +26,7 @@ jobs:
         uses: actions/checkout@v4
         with:
           repository: shaka-project/shaka-github-tools
+          persist-credentials: false
 
       # TODO: revert to micnncim and new release after landing
       #       https://github.com/micnncim/action-label-syncer/pull/68

.github/workflows/test-update-issues.yaml

@@ -24,6 +24,7 @@ jobs:
         uses: actions/checkout@v4
         with:
           ref: ${{ inputs.ref || github.ref }}
+          persist-credentials: false
 
       - name: Test
         run: |

.github/workflows/update-issues.yaml

@@ -23,6 +23,7 @@ jobs:
         uses: actions/checkout@v4
         with:
           repository: shaka-project/shaka-github-tools
+          persist-credentials: false
 
       - name: Update Issues
         env:

compute-sha/README.md

@@ -30,6 +30,7 @@ jobs:
       - uses: actions/checkout@v4
         with:
           ref: ${{ needs.compute-sha.outputs.SHA }}
+          persist-credentials: false
 
       # ...
 ```

sync-labels/sync-labels.yaml

@@ -26,6 +26,7 @@ jobs:
         uses: actions/checkout@v4
         with:
           repository: shaka-project/shaka-github-tools
+          persist-credentials: false
 
       # TODO: revert to micnncim and new release after landing
       #       https://github.com/micnncim/action-label-syncer/pull/68

update-issues/update-issues.yaml

@@ -23,6 +23,7 @@ jobs:
         uses: actions/checkout@v4
         with:
           repository: shaka-project/shaka-github-tools
+          persist-credentials: false
 
       - name: Update Issues
         env: