[Workflows] Set `persist-credentials` (#187951)
This is needed for #187905. Unless we disable the check, Zizmor will
flag uses of `actions/checkout` without an explicit
`persist-credentials` setting.
Of course, some workflows could rely on the credentials persisted by
`actions/checkout`. I asked Claude to check each affected job, and it
flagged only `prune-branches.yml`. The script `prune-unused-branches.py`
relies on the persisted credentials, so I've left that as
`persist-credentials: true` for now.
