enhance(actions): set ref_protected in context (#38852)

## Problem

The github.ref_protected Actions context value was hard-coded to false,
even when Gitea has a matching protected-branch or protected-tag rule.

That prevents policy-driven deployment workflows from relying on Gitea
as the source of truth. A deployment runner or external identity
provider may require a protected ref before releasing credentials. The
workaround is an exact-ref allowlist outside Gitea, which duplicates
repository protection policy and can drift when rules change.

## Solution

Resolve configured protection rules for branch and tag refs.
Non-branch/tag refs remain false; lookup failures are logged and
conservatively return false.

This changes the Actions context only; it does not add Actions OIDC
issuance.

---------

Co-authored-by: Giteabot <teabot@gitea.io>

models/git/ref.go

@@ -0,0 +1,36 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package git
+
+import (
+	"context"
+	"fmt"
+
+	module_git "gitea.dev/modules/git"
+)
+
+// IsRefProtected checks whether a branch or tag ref is protected.
+func IsRefProtected(ctx context.Context, repoID int64, ref module_git.RefName) (bool, error) {
+	if ref.IsBranch() {
+		return IsBranchProtected(ctx, repoID, ref.ShortName())
+	}
+	if !ref.IsTag() {
+		return false, nil
+	}
+
+	protectedTags, err := GetProtectedTags(ctx, repoID)
+	if err != nil {
+		return false, fmt.Errorf("get protected tags: %w", err)
+	}
+	for _, protectedTag := range protectedTags {
+		if err := protectedTag.EnsureCompiledPattern(); err != nil {
+			return false, fmt.Errorf("compile protected tag pattern %q: %w", protectedTag.NamePattern, err)
+		}
+		if protectedTag.matchString(ref.ShortName()) {
+			return true, nil
+		}
+	}
+
+	return false, nil
+}