ci: disable credential persistence on the remaining checkouts

Add `persist-credentials: false` to the `actions/checkout` steps in
the 5 workflows that were not covered by the earlier integration-test
change: `check.yml`, `emulate.yml`, `example-app.yml`, `javadoc.yml`,
and `release.yaml`.

By default `actions/checkout` writes a short-lived
`GITHUB_TOKEN`-derived credential into the local `.git/config` for the
duration of the job. None of these jobs perform a `git push`, create
tags, open PRs, or otherwise require write access to the repository
over git:

- `check.yml` runs Gradle linters and unit tests
- `emulate.yml` runs Android emulator tests and uploads a reports
  artifact via `actions/upload-artifact` (which uses the runtime
  artifacts API, not git)
- `example-app.yml` runs the example-app connectedAndroidTest
- `javadoc.yml` builds Javadoc and uploads it to S3 via
  `ably/sdk-upload-action`; `githubToken` is passed to that action as
  an explicit input parameter, not via the checkout-persisted
  credential, so disabling persistence does not affect the upload
- `release.yaml` publishes to Maven Central using Sonatype + GPG
  credentials from repository secrets and performs no git write

`features.yml` only invokes a reusable workflow and has no checkout
step of its own, so it requires no change here.

Author: emptyhammond

.github/workflows/check.yml

@@ -12,6 +12,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
+        with:
+          persist-credentials: false
       - name: Set up the JDK
         uses: actions/setup-java@17f84c3641ba7b8f6deff6309fc4c864478f5d62 # v3
         with:

.github/workflows/emulate.yml

@@ -17,6 +17,8 @@ jobs:
     steps:
       - name: checkout
         uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          persist-credentials: false
 
       - name: Set up the JDK
         uses: actions/setup-java@17f84c3641ba7b8f6deff6309fc4c864478f5d62 # v3

.github/workflows/example-app.yml

@@ -17,6 +17,8 @@ jobs:
     steps:
       - name: checkout
         uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          persist-credentials: false
 
       - name: Set up the JDK
         uses: actions/setup-java@17f84c3641ba7b8f6deff6309fc4c864478f5d62 # v3

.github/workflows/javadoc.yml

@@ -14,6 +14,8 @@ jobs:
       deployments: write
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          persist-credentials: false
 
       - name: Configure AWS Credentials
         uses: aws-actions/configure-aws-credentials@67fbcbb121271f7775d2e7715933280b06314838 # v1

.github/workflows/release.yaml

@@ -12,6 +12,8 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          persist-credentials: false
 
       - name: Extract tag
         id: tag