Add timeout for lock and don't keep credentials for regress, from Andreas

Fehlner.

.github/workflows/lock.yml

@@ -17,6 +17,7 @@ jobs:
   action:
     runs-on: ubuntu-latest
     if: github.repository == 'tmux/tmux'
+    timeout-minutes: 10
     steps:
       - uses: dessant/lock-threads@v6
         with:

.github/workflows/regress.yml

@@ -39,6 +39,8 @@ jobs:
     steps:
       - name: checkout
         uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - name: dependencies
         if: runner.os == 'Linux'