zizmor: set persist-credentials

per zizmor, actions/checkout should be followed by removal of credentials that
may have been saved to disk. Doing so fixes lots of whining such as:

```
warning[artipacked]: credential persistence through GitHub Actions artifacts
  --> ./.github/workflows/android.yml:27:9
   |
27 |         - name: "Checkout repository"
   |  _________^
28 | |         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
   | |________________________________________________________________________________^ does not set persist-credentials: false
   |
   = note: audit confidence → Low
   = note: this finding has an auto-fix
```

11 files changed, 28 insertions, 0 deletions

diff --git a/.github/workflows/android.yml b/.github/workflows/android.yml
index a2faa94..d9d3b36 100644
--- a/.github/workflows/android.yml
+++ b/.github/workflows/android.yml
@@ -26,6 +26,8 @@ jobs:
     steps:
       - name: "Checkout repository"
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: "Install build dependencies"
         run: |
diff --git a/.github/workflows/cmake-config.yml b/.github/workflows/cmake-config.yml
index 5b57b78..493242d 100644
--- a/.github/workflows/cmake-config.yml
+++ b/.github/workflows/cmake-config.yml
@@ -25,6 +25,8 @@ jobs:
     steps:
       - name: "Checkout repository"
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: "Setup Windows dependencies"
         if: runner.os == 'Windows'
diff --git a/.github/workflows/coverity.yml b/.github/workflows/coverity.yml
index f00e2a2..33aba2e 100644
--- a/.github/workflows/coverity.yml
+++ b/.github/workflows/coverity.yml
@@ -23,6 +23,8 @@ jobs:
     steps:
       - name: "Checkout repository"
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: "Install dependencies"
         run: |
diff --git a/.github/workflows/emscripten.yml b/.github/workflows/emscripten.yml
index 914446b..ba0eb02 100644
--- a/.github/workflows/emscripten.yml
+++ b/.github/workflows/emscripten.yml
@@ -21,6 +21,8 @@ jobs:
     steps:
       - name: "Checkout repository"
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: "Install test dependencies"
         run: |
@@ -55,6 +57,8 @@ jobs:
     steps:
       - name: "Checkout repository"
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: "Install test dependencies"
         run: |
diff --git a/.github/workflows/fedora-rawhide.yml b/.github/workflows/fedora-rawhide.yml
index c3dd8a8..4ae9158 100644
--- a/.github/workflows/fedora-rawhide.yml
+++ b/.github/workflows/fedora-rawhide.yml
@@ -24,6 +24,8 @@ jobs:
       image: fedora:rawhide@sha256:0c1f63ed8fb818fad16cf6ae091598c410a21d2e1a9adf183beb93189299bfba
     steps:
     - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      with:
+        persist-credentials: false
     - name: Install dependencies
       run: |
         dnf -y install git make clang cmake ninja-build autoconf automake libtool diffutils patch gawk perl-IO-Socket-SSL
diff --git a/.github/workflows/freebsd.yml b/.github/workflows/freebsd.yml
index b0f8390..d457941 100644
--- a/.github/workflows/freebsd.yml
+++ b/.github/workflows/freebsd.yml
@@ -23,6 +23,8 @@ jobs:
     steps:
       - name: "Checkout repository"
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: "Setup"
         run: |
@@ -51,6 +53,8 @@ jobs:
     steps:
       - name: "Checkout repository"
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: "Setup"
         run: |
diff --git a/.github/workflows/linux.yml b/.github/workflows/linux.yml
index 4fbe987..a2a85e7 100644
--- a/.github/workflows/linux.yml
+++ b/.github/workflows/linux.yml
@@ -48,6 +48,8 @@ jobs:
     steps:
       - name: "Checkout repository"
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: "Install test dependencies"
         run: |
@@ -100,6 +102,8 @@ jobs:
     steps:
       - name: "Checkout repository"
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: "Install test dependencies"
         run: |
diff --git a/.github/workflows/macos.yml b/.github/workflows/macos.yml
index c619b17..1aabcd8 100644
--- a/.github/workflows/macos.yml
+++ b/.github/workflows/macos.yml
@@ -34,6 +34,8 @@ jobs:
 
     - name: "Checkout repository"
       uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      with:
+        persist-credentials: false
 
     - name: "Run tests"
       run: ./scripts/test
diff --git a/.github/workflows/rust-openssl.yml b/.github/workflows/rust-openssl.yml
index 37d377f..600d15a 100644
--- a/.github/workflows/rust-openssl.yml
+++ b/.github/workflows/rust-openssl.yml
@@ -20,6 +20,8 @@ jobs:
     steps:
       - name: "Checkout repository"
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: "Build LibreSSL"
         run: |
diff --git a/.github/workflows/solaris.yml b/.github/workflows/solaris.yml
index 0e50f5f..ddaca56 100644
--- a/.github/workflows/solaris.yml
+++ b/.github/workflows/solaris.yml
@@ -20,6 +20,8 @@ jobs:
     steps:
       - name: "Checkout repository"
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: "Setup"
         run: |
diff --git a/.github/workflows/windows.yml b/.github/workflows/windows.yml
index 908e081..7199214 100644
--- a/.github/workflows/windows.yml
+++ b/.github/workflows/windows.yml
@@ -34,6 +34,8 @@ jobs:
     steps:
       - name: "Checkout repository"
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: "Setup MSYS2"
         id: msys2