Consider setting persist-credentials: false on read-only checkout steps in changes jobs

## Summary

Follow-up from PR #7332, requested by @LesnyRumcajs.

The PR added a preliminary `changes` job (using `dorny/paths-filter`) to several lint workflows to work around the fact that `merge_group` events do not support path filters. Each of these new `changes` jobs performs an `actions/checkout@v7` step that is read-only (only used to evaluate the diff for path filtering), but does not set `persist-credentials: false`.

zizmor flagged this as a potential "artipacked" credential persistence issue: by default, `actions/checkout` persists the Git token in the local git config, which could be exposed to subsequent steps/artifacts if not needed.

## Affected files

- `.github/workflows/actions-lint.yml`
- `.github/workflows/docker-lint.yml`
- `.github/workflows/docs-check.yml`
- `.github/workflows/go-lint.yml`
- `.github/workflows/link-check.yml`
- `.github/workflows/lists-lint.yml`
- `.github/workflows/rubocop.yml`
- `.github/workflows/shellcheck.yml`
- `.github/workflows/yaml-lint.yml`

## Suggested change

For the `actions/checkout@v7` step within each `changes` job, add:

```yaml
with:
persist-credentials: false
```

This was intentionally deferred as out-of-scope for PR #7332, which focuses on the path-filter gating logic itself.

## Acceptance criteria

- Decide whether this is worth addressing (low risk, since these are read-only checkouts in public-repo lint jobs) or can be closed as won't-fix.
- If addressed, add `persist-credentials: false` to the checkout step in each affected `changes` job across the listed workflow files.

## References

- PR: https://github.com/ChainSafe/forest/pull/7332
- Comment: https://github.com/ChainSafe/forest/pull/7332#discussion_r3552957329
- Requested by: @LesnyRumcajs