[Code scan] Pin the Gitee mirror reusable workflow before passing secrets

This issue was found during a Codex global code scan of the repository.

Baseline commit: e3c5b38a99eb7ab778b5d8c68a5ed4ddf6cf91b3

Problem

The mirror workflow passes `SYNC_GITEE_PRIVATE_KEY` to a reusable workflow referenced by the mutable `main` branch.

Code references:
https://github.com/deepmodeling/dpgui/blob/e3c5b38a99eb7ab778b5d8c68a5ed4ddf6cf91b3/.github/workflows/mirror_gitee.yml#L7-L10

Relevant snippet:
```yaml
uses: deepmodeling/workflows/.github/workflows/mirror_gitee.yml@main
secrets:
SYNC_GITEE_PRIVATE_KEY: ${{ secrets.SYNC_GITEE_PRIVATE_KEY }}
```

Impact

Any future change to `deepmodeling/workflows@main` changes the code that receives this private key. That makes the secret-bearing workflow dependent on a mutable external ref.

Suggested fix

Pin the reusable workflow to an immutable commit SHA or a protected release tag, and keep the Gitee private key scoped to the minimum required permissions.