fix(ci): authenticate trivy-action's github.com clone

On cache miss, `aquasecurity/trivy-action@master` falls back to
`git clone https://github.com/aquasecurity/trivy` to fetch its
install script. The act_runner cache server is currently
unreachable from job containers (documented as "Cache server
(deferred)" in infra/README.md), so every run is a cache miss, so
every run hits the github.com anonymous rate limit and fails with:

    fatal: could not read Username for 'https://github.com';:
    terminal prompts disabled

Pass `GITHUBCOM_TOKEN` (the same zero-scope github.com PAT we use
for Renovate) as `GITHUB_TOKEN` env on the step. The action picks
it up automatically and authenticates the clone, lifting the rate
limit from 60 req/h anonymous to 5 000 req/h authenticated.

This unblocks the `scan` job. The cache server fix would also
unblock it (no fall-back clone in the first place), but is a
separate, larger infra change still pending.

.gitea/workflows/ci.yml

@@ -66,6 +66,15 @@ jobs:
       # Dependency vulnerability scan (binary tool, invoked via official
       # action — Trivy is a Go binary, not an npm package, so it cannot
       # live in package.json scripts as cleanly as audit/lint do).
+      #
+      # On cache miss (the act_runner cache server is currently
+      # unreachable from job containers — see infra/README.md "Cache
+      # server (deferred)"), the action falls back to `git clone
+      # https://github.com/aquasecurity/trivy` to fetch its install
+      # script. Without auth that hits github.com's 60 req/h anonymous
+      # rate limit and `git fetch` fails with "could not read Username".
+      # GITHUBCOM_TOKEN is the same zero-scope github.com PAT we use
+      # for Renovate (per docs/development.md "Dependency updates").
       - uses: aquasecurity/trivy-action@master
         with:
           scan-type: fs
@@ -73,6 +82,8 @@ jobs:
           skip-dirs: node_modules
           exit-code: '1'
           severity: 'CRITICAL,HIGH'
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUBCOM_TOKEN }}
       # Secret scan, same reasoning (gitleaks is a Go binary).
       - uses: gitleaks/gitleaks-action@v2
         env: