enh(secu): stop persisting checkout credentials in scan workflows

[sc979]

Fixes: SECU-1231

Description

What are your needs or what are you planning to do in this PR?

Harden the checkout step of both reusable workflows (dependency-analysis.yml, gitleaks-analysis.yml): rename to Checkout sources, keep actions/checkout@3d3c42e5 # v7.0.1 (aligned with #70 / standardised everywhere), and set persist-credentials: false so the GITHUB_TOKEN is not left in the runner git config after checkout. gitleaks keeps fetch-depth: 0.

Regression check vs #64 (SECU-gitleaks-custom):

• dependency-analysis.yml — no regression. enh(secu): manage invalid-revision range error #64 doesn't touch it, and after checkout it does no authenticated git op (public wget + PR comment via the action).
• gitleaks-analysis.yml — one edge-case regression once enh(secu): manage invalid-revision range error #64 also merges. enh(secu): manage invalid-revision range error #64 adds a refetch() fallback that runs git fetch --force origin after checkout; with persist-credentials: false that fetch is unauthenticated and fails on private repos. It only runs on the force-push-race fallback path (normal PRs never reach it, since fetch-depth: 0 already fetched everything with the token). On main today (still gitleaks-action) there is no issue.

To keep persist-credentials: false everywhere without regression, #64's refetch() should re-authenticate the fetch via http.extraheader with github.token. Options tracked in the PR discussion / SECU-1231.

🤖 Generated with Claude Code