[Code scan] Pin the reusable Gitee mirror workflow that receives the private key

[njzjz]

This issue is a result of a Codex global code scan of deepmodeling/deepmodeling_sphinx at commit 156679f.

Problem

The Gitee mirror workflow calls a reusable workflow from deepmodeling/workflows at the mutable main ref while passing SYNC_GITEE_PRIVATE_KEY. Any change to that external repository's main branch changes the code that can handle this secret, without review in this repository.

Code references:

deepmodeling_sphinx/.github/workflows/mirror_gitee.yml

Lines 9 to 13 in 156679f

	jobs:
	git-mirror:
	uses: deepmodeling/workflows/.github/workflows/mirror_gitee.yml@main
	secrets:
	SYNC_GITEE_PRIVATE_KEY: ${{ secrets.SYNC_GITEE_PRIVATE_KEY }}

Impact

This widens the trust boundary for a private key. A benign breaking change, compromised workflow repository, or unreviewed update on main could immediately affect secret-handling behavior here.

Suggested fix

Pin the reusable workflow to an audited commit SHA or immutable release tag, and update it deliberately via reviewed PRs. If a floating ref is intentionally required, document the trust model and monitoring expectation in the workflow.