Set scope for secrets

[JakobDev]

Feature Description

Gitea has now secrets that will be used by the upcoming Actions. It makes sense, to let the User limit the Scope where these Secrets are actually available (on a Pipeline triggered by a Push/PR etc.)

Screenshots

Something like Woodpecker does:

[delvh]

Hmm, do we really need this?
If not even GitHub or GitLab support it, is there really such a huge value in adding it?
This heavily complicates the logic, and I don't think you typically need that fine-grained separation.
I personally am rather against it.

[markkrj]

This makes sense, as secrets can be exposed by malicious code in PRs. Gitea also has protected tags and branches, so it makes sense for those as well. GitHub does not allow use of secrets on PRs by default. Only on workflows triggered by specific event (pull_request_target). Does GitLab even has a built-in secret storage? I could not find. They have instructions on how to use Vault as a secret storage for its CI, and it allows for even more granularity than just refs.

[KN4CK3R]

Github does have different "scopes": Actions, Codespaces, Dependabot
If we want to use the secrets for internal logic like mirror credentials we will need different types too.