Credentials used to check out sources during a build.
The default choice of "Same as scan credentials" is sufficient so long as you don't need Jenkins to push some changes back into these repositories.
Otherwise you should create an SSH username with private key credential and
specify an SSH private key that belongs to the same user you've used for the scan
credentials. This causes Jenkins to check out source code over SSH, and therefore
you can run git push
from your pipeline to push changes back.