ci: pass the qemu tests only the secrets they use

reusable-qemu-test.yaml reads QUAY_USERNAME and QUAY_PASSWORD and nothing
else, but declares no workflow_call secrets, so its callers have to use
`secrets: inherit`. That hands every repository and organisation secret to
jobs whose whole purpose is to boot an image built from the pull request
under review.

Harmless today only by accident: GitHub withholds secrets from pull_request
runs originating in a fork, so the jobs that would be interesting to attack
never receive anything. That protection disappears the moment a
pull_request_target path exists, which is exactly what kairos#4307 is
about -- so this is worth fixing before it becomes reachable rather than
alongside it.

Declares the two secrets on the reusable workflow and passes them
explicitly from image-pr.yaml. No behaviour change: the same two values
reach the same jobs, and nothing else does.

Refs: #4307

Signed-off-by: Mauro Morales <contact@mauromorales.com>

Author: mauromorales

.github/workflows/image-pr.yaml

@@ -53,7 +53,12 @@ jobs:
       kubernetes_distro: ${{ matrix.kubernetes_distro }}
   core-tests:
     name: ${{ format('core-tests (hadron, amd64, generic) {0}', matrix.test) }}
-    secrets: inherit
+    # Explicit rather than `secrets: inherit`. reusable-qemu-test.yaml only ever
+    # reads these two, and these jobs boot an image built from the pull request
+    # under review -- so they get the registry credential and nothing else.
+    secrets:
+      QUAY_USERNAME: ${{ secrets.QUAY_USERNAME }}
+      QUAY_PASSWORD: ${{ secrets.QUAY_PASSWORD }}
     uses: ./.github/workflows/reusable-qemu-test.yaml
     with:
       base_image: "ghcr.io/kairos-io/hadron:v0.5.1"
@@ -81,7 +86,12 @@ jobs:
   standard-tests:
     name: ${{ format('standard-tests (hadron, amd64, generic) {0}', matrix.test) }}
     uses: ./.github/workflows/reusable-qemu-test.yaml
-    secrets: inherit
+    # Explicit rather than `secrets: inherit`. reusable-qemu-test.yaml only ever
+    # reads these two, and these jobs boot an image built from the pull request
+    # under review -- so they get the registry credential and nothing else.
+    secrets:
+      QUAY_USERNAME: ${{ secrets.QUAY_USERNAME }}
+      QUAY_PASSWORD: ${{ secrets.QUAY_PASSWORD }}
     permissions:
       contents: write
       security-events: write

.github/workflows/reusable-qemu-test.yaml

@@ -37,6 +37,14 @@ on:
         type: boolean
         default: false
 
+    secrets:
+      QUAY_USERNAME:
+        description: "Registry user for pulling the image under test from ci-temp-images."
+        required: true
+      QUAY_PASSWORD:
+        description: "Registry token matching QUAY_USERNAME."
+        required: true
+
 jobs:
   test:  # decentralized k8s needs to run in github hosted workers for network stuff to work
     runs-on: ${{ inputs.test == 'provider-decentralized-k8s' && 'ubuntu-24.04' || 'fast' }}