ci: run shared gitleaks secret scan

.gitea/workflows/ci.yml

@@ -0,0 +1,15 @@
+# CI for this repo - the actual checks live in the shared ci-workflows repo.
+name: ci
+
+"on":
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+
+jobs:
+  gitleaks:
+    # Short owner/repo form: Gitea resolves reusable workflows server-side and
+    # rejects absolute URLs that don't match its own ROOT_URL.
+    uses: thesabear/ci-workflows/.gitea/workflows/gitleaks.yml@main
+    secrets: inherit