Add a small note about security implications of using cibuildwheel in CI runners (#2711)

* Bump to actions/checkout v6 everywhere

* Add a note about security

* Not persisting credentials is still valuable

* Fix bad indentation

* Improve wording, remove link to PyPA guides

Co-Authored-By: Joe Rickerby <1244307+joerick@users.noreply.github.com>

---------

Co-authored-by: Joe Rickerby <1244307+joerick@users.noreply.github.com>

examples/github-deploy.yml

@@ -48,7 +48,9 @@ jobs:
             platform: pyodide
 
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
 
       - name: Build wheels
         uses: pypa/cibuildwheel@v3.3.1
@@ -70,7 +72,9 @@ jobs:
     name: Build source distribution
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
 
       - name: Build sdist
         run: pipx run build --sdist