feat: Add persist-credentials input

[Mrtenz]

Summary

• Adds a persist-credentials input passed through to the actions/checkout step.
• Defaults to true to preserve existing behaviour.
• Setting to false prevents accidental GitHub token leaks in workflows that don't need authenticated Git operations.

---

Note

Low Risk
Small, backward-compatible composite-action input with default true; only affects checkout credential persistence when callers opt out.

Overview
Adds a persist-credentials action input (default true) and forwards it to the conditional actions/checkout step so callers can disable storing the GitHub token in the repo’s git config.

Setting persist-credentials: false is intended to reduce accidental token exposure in workflows that do not need authenticated git operations after checkout; workflows that rely on the checked-out repo for authenticated GitHub API calls can keep the default.

^{Reviewed by Cursor Bugbot for commit 5a07bfa. Bugbot is set up for automated code reviews on this repo. Configure here.}

[Mrtenz]

I considered making this false by default, but that would be a breaking change as any subsequent steps would no longer to pull, fetch, push, etc. so this is the best we can do for now. We should make this false in the next major version (or even force this to be false, and have subsequent steps use the GitHub token themselves).