checkout: use sh instead of bash for credentials strip

Composite runs inside container jobs (e.g. jest-runtime, e2e runtimes)
that don't ship bash. The one-line git config command works in POSIX sh.

checkout/action.yml

@@ -53,10 +53,11 @@ runs:
 
     - name: Strip credentials before caching
       if: inputs.sparse-checkout == '' && inputs.gcs-bucket != '' && steps.restore.outputs.cache-hit != 'true'
-      shell: bash
+      shell: sh
       run: |
         # actions/checkout writes a token-bearing extraheader into .git/config; remove it
-        # so the cached tarball doesn't carry credentials across jobs.
+        # so the cached tarball doesn't carry credentials across jobs. Use sh instead of
+        # bash so the step works in minimal container images (e.g. jest-runtime).
         git -C "${GITHUB_WORKSPACE}" config --local --unset-all http.https://github.com/.extraheader || true
 
     - name: Save working tree to GCS