ci: fix infra failures — install go/python3/docker/nginx in job containers

Four CI jobs failed because the runner's node:22-alpine3.21 container
lacked required tooling (Go, Python3, Docker CLI, nginx):

- secrets-scan: add actions/setup-go@v5 before gitleaks install
- env-docs-check: apk add python3 before running check script
- docker-compose-check: apk add docker-cli docker-compose
- nginx-check: install nginx locally, validate with minimal config

.gitea/workflows/ci.yaml

@@ -31,6 +31,11 @@ jobs:
           mkdir -p /opt/hostedtoolcache/node/22.23.1/x64/bin
           ln -sf /usr/local/bin/node /opt/hostedtoolcache/node/22.23.1/x64/bin/node
 
+      - uses: actions/setup-go@v5
+        with:
+          go-version: "1.26"
+          cache: false
+
       - name: Install gitleaks
         run: go install github.com/gitleaks/gitleaks/v8@latest
 
@@ -46,6 +51,9 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
+      - name: Install python3
+        run: apk add --no-cache python3
+
       - name: Check env var documentation
         run: python3 scripts/check-env-docs.py
 
@@ -737,6 +745,9 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
+      - name: Install docker CLI
+        run: apk add --no-cache docker-cli docker-compose
+
       - name: Validate compose.yml
         run: docker compose -f compose.yml config --quiet
 
@@ -749,6 +760,10 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
+      - name: Install nginx
+        run: apk add --no-cache nginx
+
       - name: Validate nginx config
         run: |
-          docker run --rm -v $(pwd)/nginx/conf.d/default.conf:/etc/nginx/conf.d/default.conf:ro nginx:stable-alpine nginx -t 2>&1
+          echo "events {} http { include /etc/nginx/mime.types; include $(pwd)/nginx/conf.d/*.conf; }" > /tmp/nginx-test.conf
+          nginx -t -c /tmp/nginx-test.conf