ci:harden workflow checkout for pull_request_target safety

Signed-off-by: Parv Ninama <ninamaparv@gmail.com>

Author: parvninama

.github/scripts/shared/core/eligibility.js

@@ -167,7 +167,7 @@ function getNextLevelInfo(currentLevelKey) {
  *   observed completed count === requiredCount
  *
  * Uses a capped query (requiredCount + 1) for efficiency.
- * 
+ *
  * @param {import('@actions/github').GitHub} github
  * @param {object} homeRepo
  * @param {string} username

.github/workflows/bot-next-issue-recommendation.yml

@@ -25,8 +25,13 @@ jobs:
         with:
           egress-policy: audit
 
-      - name: Checkout repository
+      # pull_request_target runs with privileged context.
+      # Explicitly checkout trusted base repository code only
+      - name: Checkout trusted base repository
         uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        with:
+          persist-credentials: false
+          ref: ${{ github.event.repository.default_branch }}
 
       - name: Recommend next issue
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 #v9.0.0