ifix(ci): do not persist checkout credentials when not required

.github/workflows/ci.yml

@@ -49,6 +49,8 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
 
       - name: Dependency Review
         uses: actions/dependency-review-action@3b139cfc5fae8b618d3eae3675e383bb1769c019 # v4

.github/workflows/release.yml

@@ -21,6 +21,7 @@ jobs:
         token: ${{ secrets.POST_RELEASE_GH_TOKEN }}
         fetch-depth: 0
         cache-read-only: ${{ github.ref != 'refs/heads/main' }}
+        persist-credentials: true
 
     - name: Set up Git author
       shell: bash