chore: CCIE-3986 use persist-credentials: false in checkout

[wontonst]

I did a manual inspection of the files but no guarantees that this won't break something.

If anyone knows of a place where we run privileged git commands other than update manifest, please let me know.

If this PR doesn't end up breaking anything I'll open PRs for other repos using the same approach.

[wontonst]

not sure if we just accept this risk or if we want to do something about this

in my experience, automation doesn't make commits against the repo. the name of the artifact is also not something baked into the repo that get constantly updated. it's usually an external system managing the mapping of git hash to docker img tag, and that system will also keep track of what's deployed in prd/staging. sounds like that should be all done in argus so I'm curious if that's something that's possible/something we've considered doing.

[jakeyheath]

I'll trust you if you test it out and everything works. I'm not exactly familiar with this feature, but would like to see more familiarity with this pattern if it does work.

[wontonst]

I'll trust you if you test it out and everything works. I'm not exactly familiar with this feature, but would like to see more familiarity with this pattern if it does work.

it's hard to test this out since this affects consumers of these actions. eg if someone is doing a git push using the creds obtained in one of the actions affected by this change, that command will break.

it might make sense to break their workflow anyway and have them use GITHUB_TOKEN which lets them decide whether they want to grant write permissions