ci(changelog): disable checkout credential persistence

The changelog-entry-required job is read-only (git show/diff over
already-fetched history, no push), so it does not need the GITHUB_TOKEN
left in .git/config on the runner. Addresses CodeRabbit/zizmor artipacked.

Leaving actions/checkout pinned to @v4 to match the repo-wide convention
(all 28 checkout uses pin by tag, none by SHA); SHA-pinning belongs in a
dedicated repo-wide hardening pass, not this single-workflow PR.

Author: elkaix

.github/workflows/changelog-entry-required.yml

@@ -28,6 +28,9 @@ jobs:
         uses: actions/checkout@v4
         with:
           fetch-depth: 0
+          # Read-only job (git show/diff on already-fetched history, no push);
+          # do not leave the token in .git/config on the runner.
+          persist-credentials: false
 
       - name: Require a CHANGELOG entry for shipped-code changes
         env: