ci: add persist-credentials: false to checkout steps

[knqyf263]

Description

Set persist-credentials: false on actions/checkout steps that don't require git push, preventing the GITHUB_TOKEN from being stored in .git/config and reducing the attack surface for credential theft by compromised dependencies or scripts.

Reference: https://github.com/goreleaser/example-secure/blob/main/.github/workflows/release.yml

Changed workflows (19 checkout steps across 9 files):

• test.yaml (7 steps)
• cache-test-assets.yaml (3 steps)
• publish-chart.yaml (2 steps)
• release.yaml (2 steps: deploy-packages 1st checkout, update-chart-version)
• reusable-release.yaml (1 step)
• scan.yaml (1 step)
• spdx-cron.yaml (1 step)
• triage.yaml (1 step)
• auto-update-labels.yaml (1 step)

Intentionally excluded (require git push):

• backport.yaml — backport script pushes branches
• release.yaml trivy-repo checkout — deploy scripts push to trivy-repo
• mkdocs-dev.yaml / mkdocs-latest.yaml / test-docs.yaml — mike deploys with --push

Related issues

• Close Add persist-credentials: false to GitHub Actions checkout steps #10305

Checklist

• I've read the guidelines for contributing to this repository.
• I've followed the conventions in the PR title.
• I've added tests that prove my fix is effective or that my feature works.
• I've updated the documentation with the relevant information (if needed).
• I've added usage information (if the PR introduces new options)
• I've included a "before" and "after" example to the description (if the PR is a user interface change).

[DmitriyLewen]

IIUC we will see an error in mage helm:updateVersion.
git push will be failed:

trivy/magefiles/helm.go

Line 47 in 8c9a92b

[]string{"git", "push", "origin", newBranch},

[knqyf263]

Nice catch
#10306

[DmitriyLewen]

nit:
Do we want to explicitly specify persist-credentials: true and add a comment for why we need to keep credentials:

     - name: Checkout trivy-repo
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
		with:
			persist-credentials: true # deploy-rpm.sh and deploy-deb.sh require permissions to push changes into trivy-repo
			repository: ${{ github.repository_owner }}/trivy-repo
...

Same for backport.yaml

[knqyf263]

done
#10306