fix what I can for zizmor

Author: graingert

.github/workflows/ci.yml

@@ -37,6 +37,8 @@ jobs:
 
       - name: Grab the source from Git
         uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - name: Get the dist version
         id: dist-version
@@ -99,6 +101,7 @@ jobs:
         uses: actions/checkout@v4
         with:
           path: git-src
+          persist-credentials: false
 
       - name: >-
           Smoke-test: install test requirements from the Git repo