fix(security): add secret-scan step to CI (both .gitea and .github variants)

Had a real dependency/container-image Trivy scan but no secret scan.
Adds trufflehog (Marketplace Action) as the first step after checkout
in both the .gitea/workflows/ and .github/workflows/ copies of this
workflow (kept in sync as platform-specific variable-syntax variants of
the same pipeline) - the last gap for this repo to count as
fully-authored.

.gitea/workflows/release-gates.yml

@@ -21,6 +21,11 @@ jobs:
     timeout-minutes: 45
     steps:
       - uses: actions/checkout@v4
+      - name: Secret scan
+        uses: trufflesecurity/trufflehog@v3.79.0
+        with:
+          path: ./
+          extra_args: --only-verified
       - uses: actions/setup-python@v5
         with:
           python-version: "3.11"