fix(ci): authenticate trivy-action's github.com clone (#44)

## Summary
On cache miss, `aquasecurity/trivy-action@master` falls back to `git clone https://github.com/aquasecurity/trivy` to fetch its install script. Our act_runner cache server is currently unreachable from job containers (documented as "Cache server (deferred)" in `infra/README.md`), so every CI run is a cache miss, every run does the clone, and every clone hits github.com's 60 req/h anonymous rate limit:

Pass `GITHUBCOM_TOKEN` (same zero-scope github.com PAT used for Renovate) as `GITHUB_TOKEN` env on the trivy step. The action picks it up automatically and authenticates the clone, lifting the rate limit from 60 → 5 000 req/h.

## Test plan
- [ ] `scan` job goes green on this PR (the trivy step in particular).
- [ ] On `push` to main post-merge, scan stays green.
- [ ] No regression on the audit / gitleaks sub-steps of `scan`.

## Related
- The deeper fix (re-enabling the act_runner cache server so trivy gets a real cache hit and skips the clone entirely) is tracked as "Cache server (deferred)" in `infra/README.md`. Worth doing eventually; this PR is the surgical fix.
- The `@master` pin on the trivy-action is also worth replacing with a tagged version (`renovate.json` will surface bumps once we lift the major-dashboard gate for it). Out of scope for this PR.

---------

Co-authored-by: Julien Gautier <julien.gautier@apf.asso.fr>
Reviewed-on: #44

.gitea/workflows/ci.yml

@@ -66,6 +66,15 @@ jobs:
       # Dependency vulnerability scan (binary tool, invoked via official
       # action — Trivy is a Go binary, not an npm package, so it cannot
       # live in package.json scripts as cleanly as audit/lint do).
+      #
+      # On cache miss (the act_runner cache server is currently
+      # unreachable from job containers — see infra/README.md "Cache
+      # server (deferred)"), the action falls back to `git clone
+      # https://github.com/aquasecurity/trivy` to fetch its install
+      # script. Without auth that hits github.com's 60 req/h anonymous
+      # rate limit and `git fetch` fails with "could not read Username".
+      # GITHUBCOM_TOKEN is the same zero-scope github.com PAT we use
+      # for Renovate (per docs/development.md "Dependency updates").
       - uses: aquasecurity/trivy-action@master
         with:
           scan-type: fs
@@ -73,6 +82,8 @@ jobs:
           skip-dirs: node_modules
           exit-code: '1'
           severity: 'CRITICAL,HIGH'
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUBCOM_TOKEN }}
       # Secret scan, same reasoning (gitleaks is a Go binary).
       - uses: gitleaks/gitleaks-action@v2
         env: