ci: use persist-credentials: false in testgen.yml

We were consistent about doing this in the main CI workflow, but not the
testgen workflow. This is flagged[0] when running Zizmor 0.7.0 on the
repo's CI config.

[0]: https://woodruffw.github.io/zizmor/audits/#artipacked

.github/workflows/testgen.yml

@@ -20,6 +20,8 @@ jobs:
     steps:
       - name: Check out source repository
         uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - name: Set up Python environment
         uses: actions/setup-python@v5
@@ -47,6 +49,8 @@ jobs:
     steps:
       - name: Check out source repository
         uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - name: Set up Rust toolchain
         uses: dtolnay/rust-toolchain@stable