Reduce checkout and cache persistence in workflows

Set actions/checkout persist-credentials: false across jobs that only need a read-only working tree. This keeps the repository token out of local git config and prevents it from being carried into later steps or uploaded artifacts.

Switch GitHub Actions caches used by untrusted or artifact-producing jobs to lookup-only, and disable setup-go caching where zizmor flagged cache poisoning risk. These jobs still restore dependency state where useful but do not write new cache entries from those runs.

Keep an explicit artipacked suppression on the manual lint-fix workflow because its final git-auto-commit step intentionally needs checkout credentials to push the generated fix commit.

.github/workflows/complement_tests.yml

@@ -42,6 +42,7 @@ jobs:
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           path: synapse
+          persist-credentials: false
 
       # Log Docker system info for debugging (compare with your local environment) and
       # tracking GitHub runner changes over time (can easily compare a run from last