Had a real dependency/container-image Trivy scan but no secret scan.
Adds trufflehog (Marketplace Action) as the first step after checkout
in both the .gitea/workflows/ and .github/workflows/ copies of this
workflow (kept in sync as platform-specific variable-syntax variants of
the same pipeline) - the last gap for this repo to count as
fully-authored.