Add reusable scan workflow for consumer repos

[satsura]

Mirrors how startmatter/defectdojo-ci is consumed today, so swapping one for the other is an eight-line change in a repository.

jobs:
  security:
    uses: startmatter/cerberus/.github/workflows/scan.yml@main
    with:
      runner: self-hosted
      dns: 1.1.1.1,8.8.8.8
    secrets:
      K_SARIF_URL: ${{ secrets.K_SARIF_URL }}
      K_SARIF_SECRET: ${{ secrets.K_SARIF_SECRET }}

• Checks out with fetch-depth: 0 (Gitleaks scans the whole history)
• Secrets are declared explicitly, not inherited — secrets: inherit does not cross organization boundaries and callers may live in another org
• Skips with a warning when the ingest secrets are absent, so merging this into a repo before the tracker integration exists cannot turn its pipelines red
• REGISTRY_TOKEN for callers in another organization: their own job token cannot read a private package owned by ours