Avoid flaky authenticated Git fetch for nanobench

[scal444]

• fetch nanobench v4.1.0 from a checksummed source archive instead of a nested Git clone
• disable persisted checkout credentials in the C++ build workflow, which does not perform later authenticated Git operations

The C++ configure job intermittently receives an authentication challenge while cloning the public nanobench repository. The checkout action persists a GitHub-wide authorization header in the checkout Git config, and CMake runs the dependency clone beneath that checkout. Using an archive removes the Git smart-HTTP and credential-inheritance path entirely; disabling credential persistence prevents similar unintended authentication in later commands.

[greptile-apps]

Greptile Summary

This PR avoids credential inheritance during the C++ build by disabling persisted checkout credentials and replacing nanobench’s nested Git clone with a SHA-256-verified source archive.

• Configures actions/checkout not to persist credentials.
• Fetches nanobench v4.1.0 from a checksummed GitHub archive.

Confidence Score: 5/5

The PR appears safe to merge, with no concrete blocking or non-blocking defects identified.

The workflow does not require persisted credentials after checkout, and the archive-based nanobench dependency preserves the existing target integration while adding integrity verification.

Important Files Changed

Filename	Overview
.github/workflows/cpp-build-test.yml	Disables persisted checkout credentials; subsequent workflow operations do not rely on them.
cmake/nanobench.cmake	Replaces the nanobench Git clone with a versioned, checksum-verified archive while preserving the existing FetchContent integration.

_{Reviews (1): Last reviewed commit: "Avoid authenticated Git clone for nanobe..." | Re-trigger Greptile}

[scal444]

Hoping this removes the inconsistent failures

[evasnow1992]

Thank you for fixing this random credential issue.