ci: disable credential persistence on checkout

Set persist-credentials: false on actions/checkout so the default
GITHUB_TOKEN is not left in the local git config after checkout.
Identified by a routine workflow security audit.

Author: emptyhammond

.github/workflows/review-app.yml

@@ -18,6 +18,8 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - name: Check if user is an Ably organization member
         if: github.event.action == 'labeled' && github.event.label.name == 'review-app'