ci: use persist-credentials: false throughout

We already do this in most of the other Rustls crates, and Zizmor 0.7.0
flags[0] its absence in this repo.

[0]: https://woodruffw.github.io/zizmor/audits/#artipacked

.github/workflows/ci.yml

@@ -13,13 +13,17 @@ jobs:
     runs-on: macos-latest
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - run: brew tap rustls/ci --custom-remote .
       - run: brew audit --online --strict rustls/ci/curl
 
   test:
     runs-on: macos-latest
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - run: brew tap rustls/ci --custom-remote .
       - run: brew reinstall --verbose rustls/ci/curl
       - run: brew test rustls/ci/curl
@@ -28,5 +32,7 @@ jobs:
     runs-on: macos-latest
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - run: brew tap rustls/ci --custom-remote .
       - run: brew style rustls/ci/curl