ci: add read-only pull secret to security build

.woodpecker/build-container.yml

@@ -13,6 +13,8 @@ steps:
       output: type=oci,dest=oci/${CI_REPO_NAME},tar=false
       repo: thegeeklab/${CI_REPO_NAME}
       cache_to: type=local,dest=oci/cache/${CI_REPO_NAME},mode=max
+      registry_config:
+        from_secret: DOCKER_REGISTRY_CONFIG_PULL
 
   - name: security-scan
     image: docker.io/aquasec/trivy