fix(ci): pass reusable workflows only the secrets they declare

mirror-reusable declares seven optional mirror keys; secret-scanner-reusable
declares none and its header says callers pass no secrets: line. Replace
secrets: inherit with the explicit mapping (mirror) and nothing (scanner)
so unrelated repo/org secrets are not forwarded. Flagged by zizmor
secrets-inherit via CodeRabbit.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019a95kk88TZ1iegsBK3kox3

Author: claude

.github/workflows/mirror.yml

@@ -16,4 +16,11 @@ permissions:
 jobs:
   mirror:
     uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@333b06a01db1874ffedb2de1bfabb195640927c7
-    secrets: inherit
+    secrets:
+      GITLAB_SSH_KEY: ${{ secrets.GITLAB_SSH_KEY }}
+      BITBUCKET_SSH_KEY: ${{ secrets.BITBUCKET_SSH_KEY }}
+      CODEBERG_SSH_KEY: ${{ secrets.CODEBERG_SSH_KEY }}
+      SOURCEHUT_SSH_KEY: ${{ secrets.SOURCEHUT_SSH_KEY }}
+      DISROOT_SSH_KEY: ${{ secrets.DISROOT_SSH_KEY }}
+      GITEA_SSH_KEY: ${{ secrets.GITEA_SSH_KEY }}
+      RADICLE_KEY: ${{ secrets.RADICLE_KEY }}

.github/workflows/secret-scanner.yml

@@ -22,4 +22,3 @@ jobs:
     permissions:
       contents: read
     uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@333b06a01db1874ffedb2de1bfabb195640927c7
-    secrets: inherit