Disable credential persistence in GitHub Actions workflows (#378)

Add persist-credentials: false to the actions/checkout steps in both
workflows, following the OpenSSF-recommended default. This prevents the
GITHUB_TOKEN from being written to .git/config for later steps.


Claude-Session: https://claude.ai/code/session_01YQQqMUxmvcm7kVSY4azyiN

Co-authored-by: Claude <noreply@anthropic.com>

Author: ludeeus

.github/workflows/lint.yml

@@ -17,6 +17,8 @@ jobs:
     steps:
       - name: Checkout the repository
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
 
       - name: Set up Python
         uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0

.github/workflows/validate.yml

@@ -20,6 +20,8 @@ jobs:
     steps:
       - name: Checkout the repository
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
 
       - name: Run hassfest validation
         uses: home-assistant/actions/hassfest@f4ca6f671bd429efb108c0f2fa0ae8af0215986c # master