What does this PR do?

Adds persist-credentials: false to all 56 actions/checkout steps across 22 workflow files and the test-apps.cue CUE template (which regenerates test-apps.yml). Also adds explicit permissions: blocks to 6 workflows that were inheriting repo defaults, and fixes two stale/missing version comments.

Motivation

actions/checkout defaults to persist-credentials: true, which stores GITHUB_TOKEN in .git/config as http.https://github.com/.extraheader for the lifetime of the job. Any subsequent step — including third-party actions — can read that credential and use it to push code, create releases, or access private repos. This is the primary vector used in the tj-actions/changed-files supply chain attack.

Setting persist-credentials: false eliminates this residual credential exposure. The one workflow that performs a git push (sync-cue-actions.yml) now injects credentials via git remote set-url scoped only to that step.

Reviewer's Checklist

• New code is free of linting errors. You can check this by running make lint locally.
• All generated files are up to date (test-apps.yml regenerated from test-apps.cue).
• Changed code has unit tests for its functionality at or near 100% coverage.
• System-Tests covering this feature have been added and enabled with the va.b.c-dev version tag.
• There is a benchmark for any new code, or changes to existing code.
• If this interacts with the agent in a new way, a system test has been added.
• Non-trivial go.mod changes, e.g. adding new modules, are reviewed by @DataDog/dd-trace-go-guild.