Allowlisting gitea-actions lets any workflow of the repository with write access push matching tags, the same trade-off branches already have. Allowing gitea:deploy-key is new for tags. Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>