fix(security): set up SSH so classpath jobs can clone private git deps

[arootroatch]

Draft for review — do not merge yet.

Problem

clj-kondo and clj-watson build the full classpath (clojure -Spath / clj-watson scan -p deps.edn), which forces resolution of private git dependencies. The reusable workflow has no SSH setup, so those two jobs only pass when a warm ~/.gitlibs cache already contains the dep. On a cold cache — which happens after any deps.edn change — they fail with:

git@github.com: Permission denied (publickey).
fatal: Could not read from remote repository.

clj-holmes, gitleaks, shellcheck, and semgrep don't build the classpath and are unaffected.

Fix

• Add an optional, scoped private-git-ssh-key workflow_call secret (not a return to blanket secrets: inherit).
• Add a "Set up SSH for private git deps" step to only the two classpath-building jobs (clj-kondo, clj-watson). It mirrors the consumers' existing build workflows: write the deploy key to ~/.ssh/id_ed25519, chmod 600, ssh-keyscan github.com.
• The step self-skips when the secret is unset (::notice::no private-git-ssh-key provided), so consumers without private git deps — and this repo's own self-test.yml (no deps.edn) — are unaffected.

Consumer usage

Consumer wrapper passes its existing SSH deploy-key secret through explicitly:

    uses: cleancoders/github-actions/.github/workflows/security.yml@v1
    with:
      clj-watson-blocking: true
      semgrep-blocking: true
    secrets:
      private-git-ssh-key: ${{ secrets.<YOUR_DEPLOY_KEY_SECRET> }}

Rollout / proof

Consumers pin @v1. To prove this end-to-end, a downstream consumer's wrapper is temporarily pointed at this fix branch and its security run goes fully green (all six jobs, including the now-enforcing clj-watson + semgrep). Final state re-pins consumers to @v1 once this merges and v1 is re-tagged to include it — the temporary branch pin is reverted before the downstream PR merges.

actionlint clean on security.yml and self-test.yml.