ci: add some missing persist-credentials

Most of the checkout action usages in `ci.yml` already specified
`persist-credentials: false`, but a few were missing it. This is
flagged[0] when running Zizmor 0.7.0 on the repo's CI config.

[0]: https://woodruffw.github.io/zizmor/audits/#artipacked

Author: cpu

.github/workflows/ci.yml

@@ -147,6 +147,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       # Turn on Linux KVM features/support for faster Android emulation.
       # References:
@@ -199,6 +201,8 @@ jobs:
     runs-on: macos-latest
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - name: Run iOS tests
         run: |
           rustup target add aarch64-apple-ios-macabi
@@ -209,6 +213,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - name: test on freebsd
         uses: vmactions/freebsd-vm@v1
         # Settings adopted from https://github.com/quinn-rs/quinn