fix(ci): use actions/upload-artifact@v3, not v4, on this Gitea runner

Verified empirically by pushing and inspecting the real run
(git.siax.io/sax3l/0pt/actions/runs/4788): v4 (pinned SHA) failed with
conclusion=failure on both upload steps. continue-on-error already kept
this from breaking the build, but the artifacts silently weren't being
saved. v3.2.2 is the known-compatible version for self-hosted Gitea's
artifact backend; re-verify after push.

.gitea/workflows/security.yml

@@ -48,7 +48,7 @@ jobs:
       - name: Upload SBOM
         if: always()
         continue-on-error: true # informational artifact; must never block the blocking scan above
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@c6a366c94c3e0affe28c06c8df20a878f24da3cf # v3.2.2 (Gitea Actions runner rejects v4 artifacts -- verified empirically 2026-08-11)
         with:
           name: sbom-cyclonedx
           path: sbom.cdx.json
@@ -86,7 +86,7 @@ jobs:
         run: |
           pnpm licenses list --json > licenses.json || true
           pnpm licenses list
-      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+      - uses: actions/upload-artifact@c6a366c94c3e0affe28c06c8df20a878f24da3cf # v3.2.2 (Gitea Actions runner rejects v4 artifacts -- verified empirically 2026-08-11)
         continue-on-error: true # informational artifact; must never block CI
         with:
           name: license-inventory