ci: don't persist creds in check.yaml

This fixes two small findings from `zizmor` for unnecessary credential-persistence.

.github/workflows/check.yaml

@@ -18,6 +18,8 @@ jobs:
         python: ["3.8", "3.9", "3.10", "3.11", "3.12"]
     steps:
       - uses: actions/checkout@v3
+        with:
+          persist-credentials: false
       - name: Setup Python
         uses: actions/setup-python@v4
         with:
@@ -40,6 +42,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v3
+        with:
+          persist-credentials: false
       - name: Setup Python
         uses: actions/setup-python@v4
         with: