SECCMP-1797: Add persist-credentials: false to copyright-check checkouts

Prevents the write token from being persisted to disk (.git/config)
after checkout. This limits exposure if attacker-controlled PR code
could read files from the runner filesystem.

Author: GAdityaVarma

.github/workflows/copyright-check.yml

@@ -18,13 +18,15 @@ jobs:
       with:
         ref: ${{ github.event.pull_request.head.sha }}
         path: target-repo
+        persist-credentials: false
 
     - name: Checkout pr-workflows repo
       uses: actions/checkout@v4
       with:
         repository: ${{ github.repository_owner }}/pr-workflows
         ref: main
         path: pr-workflows
+        persist-credentials: false
 
     - name: Setup config
       id: setup-config
@@ -135,4 +137,4 @@ jobs:
 
     - name: No-op summary
       if: steps.changed-files.outputs.skip-validation == 'true'
-      run: echo "::notice title=Copyright Check::No files to validate"
+      run: echo "::notice title=Copyright Check::No files to validate"