ci: install git for gitleaks, use nginx default config for validation

- secrets-scan: install git before gitleaks (gitleaks needs git in PATH
  to scan the repository; the node:22-alpine3.21 container lacks it)
- nginx-check: copy site config into /etc/nginx/conf.d/ and use
  'nginx -t' with default config instead of constructing a custom one
  (avoids fastcgi_params resolution issues with relative includes)

.gitea/workflows/ci.yaml

@@ -36,6 +36,9 @@ jobs:
           go-version: "1.26"
           cache: false
 
+      - name: Install git (required by gitleaks)
+        run: apk add --no-cache git
+
       - name: Install gitleaks
         run: go install github.com/zricethezav/gitleaks/v8@latest
 
@@ -768,5 +771,5 @@ jobs:
 
       - name: Validate nginx config
         run: |
-          echo "events {} http { include /etc/nginx/mime.types; include $(pwd)/nginx/conf.d/*.conf; }" > /tmp/nginx-test.conf
-          nginx -t -c /tmp/nginx-test.conf
+          cp $(pwd)/nginx/conf.d/default.conf /etc/nginx/conf.d/
+          nginx -t