ci: Have coverity workflow run against PR code

Checkout the head of the pull request code instead of the
target branch, this is needed when using `pull_request_target`
workflow.

.github/workflows/coverity.yml

@@ -25,6 +25,9 @@ jobs:
     steps:
     - name: Checkout repository
       uses: actions/checkout@v4
+      with:
+        ref: ${{ github.event.pull_request.head.sha }}
+        persist-credentials: false
 
     - name: Install dependencies
       uses: ./.github/actions/install-dependencies