Had a real dependency/container-image Trivy scan but no secret scan. Adds trufflehog (Marketplace Action) as the first step after checkout in both the .gitea/workflows/ and .github/workflows/ copies of this workflow (kept in sync as platform-specific variable-syntax variants of the same pipeline) - the last gap for this repo to count as fully-authored.