GH Actions: do not persist credentials

[jrfnl]

By default, using actions/checkout causes a credential to be persisted in the checked-out repo's .git/config, so that subsequent git operations can be authenticated.

Subsequent steps may accidentally publicly persist .git/config, e.g. by including it in a publicly accessible artifact via actions/upload-artifact.

However, even without this, persisting the credential in the .git/config is non-ideal unless actually needed.

Remediation

Unless needed for git operations, actions/checkout should be used with persist-credentials: false.

If the persisted credential is needed, it should be made explicit with persist-credentials: true.

This has now been addressed in all workflows.

Refs:

• https://unit42.paloaltonetworks.com/github-repo-artifacts-leak-tokens/
• https://docs.zizmor.sh/audits/#artipacked

[jrfnl]

Leaving this open until a new PHPCS version is released. This may break the update-phpcs-versionnr.yml workflow. So better to merge this when we can test it still works correctly (and revert that part if needed).