Improve capa checkout in sync workflow

- Do not include `CAPA_TOKEN` token as capa is a public repo and token
is not needed for checkout.
- Do not checkout `tests/data` submodule. Instead checkout only
`capa-rules`. This also automatically checkouts the correct version
without needing to update the submodule after the checkout (as it uses
`$GITHUB_SHA`).

.github/workflows/sync.yml

@@ -28,15 +28,16 @@ jobs:
     runs-on: ubuntu-latest
     needs: update_num_rules
     steps:
+    # Do not checkout submodules as we don't need capa-testfiles and we need to
+    # update the rules submodule reference
     - name: Checkout capa
       uses: actions/checkout@v2
       with:
         repository: fireeye/capa
-        token: ${{ secrets.CAPA_TOKEN }}
-        submodules: true
-    - name: Sync rules submodule
-      run: |
-        git submodule update --remote rules
+    - name: Checkout capa-rules
+      uses: actions/checkout@v2
+      with:
+        path: rules
     - name: Update rules number badge in README
       run: |
         num_rules=$(find rules -type f -name '*.yml' -not -path 'rules/.github/*' | wc -l)