Disable credential persistence in GitHub Actions checkout

[jwilder]

What changed

Added persist-credentials: false to every actions/checkout@v6 step in:

• .github/workflows/ci.yml
• .github/workflows/codeql.yml

Why

This fixes the finding that checkout was persisting repository credentials in workflow jobs even though these jobs only need read access to fetch source code. Disabling credential persistence reduces unnecessary credential exposure in CI and CodeQL runs.

How to verify

• Review both workflow files and confirm each actions/checkout@v6 step sets persist-credentials: false.
• Run or inspect the CI and CodeQL workflows to confirm they still complete successfully with checkout, build, test, lint, vulncheck, e2e, and analysis steps unchanged.