[Code scan] Pin the reusable Gitee mirror workflow that receives the private key

This issue is a result of a Codex global code scan of deepmodeling/deepmodeling_sphinx at commit 156679fe55fc61e8ec3b1e9be8a45fde3567b9cb.

Problem

The Gitee mirror workflow calls a reusable workflow from `deepmodeling/workflows` at the mutable `main` ref while passing `SYNC_GITEE_PRIVATE_KEY`. Any change to that external repository's `main` branch changes the code that can handle this secret, without review in this repository.

Code references:

https://github.com/deepmodeling/deepmodeling_sphinx/blob/156679fe55fc61e8ec3b1e9be8a45fde3567b9cb/.github/workflows/mirror_gitee.yml#L9-L13

Impact

This widens the trust boundary for a private key. A benign breaking change, compromised workflow repository, or unreviewed update on `main` could immediately affect secret-handling behavior here.

Suggested fix

Pin the reusable workflow to an audited commit SHA or immutable release tag, and update it deliberately via reviewed PRs. If a floating ref is intentionally required, document the trust model and monitoring expectation in the workflow.