feat(go-ci): support private Go module dependencies

[juicycleff]

What and why

go-ci.yml had no path for a private intra-org Go module dependency. The
workflow_call.secrets block only declared CODECOV_TOKEN, and nothing in
the file set GOPRIVATE or an insteadOf rewrite. A caller can't inject a
step into a reusable workflow's own jobs, so no amount of work on the
consumer's side could fix this. It just bit a newly published module that
depends on a private repo in the same org, and its CI can't fetch that
dependency.

This adds an optional XRAPH_REPO_TOKEN secret and a "Configure Go module
auth" step that runs before each job's Set up Go step. When the secret is
set, it rewrites github.com/ URLs to authenticate with the token and sets
GOPRIVATE. When it isn't, the step does nothing.

No-op for existing callers

XRAPH_REPO_TOKEN is required: false and every existing caller leaves it
unset. With it unset, the new step's if [ -n "..." ] guard is false, so the
step runs and exits clean without touching git config or GOPRIVATE. No
existing caller changes behavior.

Which jobs gained the step

test, lint, verify and security. I checked the other two jobs in the
file: setup never checks out the repo or runs go, so it doesn't need it,
and nested-modules only runs go mod edit -json against local go.mod
files plus a direct proxy.golang.org lookup, neither of which resolves the
repo's own dependency graph, so it doesn't need it either.

Using it

secrets:
  CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
  XRAPH_REPO_TOKEN: ${{ secrets.XRAPH_REPO_TOKEN }}

If your workflow already uses secrets: inherit, you get this for free and
don't need to touch anything. If you pass secrets explicitly, the way the
README recommends, add the XRAPH_REPO_TOKEN line yourself or your caller
keeps failing on the private dependency with no warning that a fix exists.

GOPRIVATE defaults to github.com/xraph/*, now exposed as the
private-module-pattern input rather than hardcoded, since a value a caller
can see and override beats one buried in a shell script.

v1 is a moving tag

Merging this and re-pointing v1 propagates to every repo in the org
immediately. I'm not moving the tag or merging this myself, that's on you.

Verified

• actionlint passes clean on the file.
• Read the diff for the no-op property: with the secret unset, the added
  step's body never executes, and set -euo pipefail doesn't turn that into
  a failure.
• Can't run GitHub Actions from here, so I'm not claiming the workflow
  passes, only that the change parses and reads as inert for existing
  callers.

[juicycleff]

Closing as a duplicate. #5 landed the same capability first and did it better: it documents that the GOPRIVATE glob also sets GONOPROXY, so a broad glob drags public modules off the proxy into a full git clone per job. v1 already points at that commit, so nothing here is needed.

Keeping the note about callers for whoever hits this next: a caller using secrets: inherit picks the token up automatically, but one that passes secrets explicitly has to add XRAPH_REPO_TOKEN alongside CODECOV_TOKEN, or the token never reaches the reusable workflow and the failure looks identical to having no fix at all.