Suggesting that users opt out of persisting credentials by default is a
stronger security posture. Including this in the example.

* Prevent credentials from being written to disk

I had made a previous attempt at this, but used an approach that wrote
credentials to `~/.gitconfig`. By piping credentials to `git
credentials approve` we eliminate writing credentials altogether.
Additionally, we're now cleaning up the credential cache before
completing the workflow.

Open question: is a timemout of five minutes sufficient?

* Use `git credential-cache store` to start daemon

See https://github.com/actions/checkout/blob/main/CHANGELOG.md#v500