feat(go-ci): fetch private modules when given a token

[juicycleff]

kgkit is private. Every xraph repo that depends on it fails at go mod download
with "repository not found", which reads like a bad import path and is not one.
Go asked proxy.golang.org, got a 404 back, and never tried git, because nothing
had marked that path private.

go-ci.yml now takes an optional XRAPH_REPO_TOKEN. Set it and every job that
downloads dependencies rewrites the org's HTTPS clone URL to carry the token,
then exports GOPRIVATE so those paths skip the proxy. Leave it out and the
step does nothing, so every current caller is untouched.

jobs:
  ci:
    uses: xraph/workflows/.github/workflows/go-ci.yml@v1
    with:
      goprivate: github.com/xraph/kgkit
    secrets:
      XRAPH_REPO_TOKEN: ${{ secrets.XRAPH_REPO_TOKEN }}

Two choices worth flagging, since both could reasonably have gone the other way.

The URL rewrite covers https://github.com/xraph/ rather than all of
github.com. twinos does the broad version inline, and it works, but this file
runs in every Go repo we have. Scoped to the org it cannot clobber a credential
a consumer already set up for somewhere else.

GOPRIVATE is an input instead of a hardcoded github.com/xraph/*, because it
also sets GONOPROXY. A glob wider than what is genuinely private drags public
modules off the proxy and clones each one from scratch in every job. foundry is
the case in point: twenty-two xraph modules, exactly one of them private. The
default stays github.com/xraph/*, which is right for a caller that has not
thought about it, so nothing changes for anyone who does not pass the input.

nested-modules is untouched. It reads go.mod files and never downloads.

Verified with actionlint locally. The self-test smoke jobs call this workflow
without the secret, which exercises the no-op path.