fix(ci): use CRT_READ_ONLY for cross-repo clone

actions/checkout@v3's Basic auth header pattern fails with 403 when
accessing a different private repository. Switch to a plain git clone
with the CRT_READ_ONLY token embedded in the HTTPS URL.

.gitea/workflows/build.yaml

@@ -15,12 +15,14 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v3
 
-      - name: Checkout schwab-scraper
-        uses: actions/checkout@v3
-        with:
-          repository: b3nw/schwab-scraper
-          path: vendor/schwab-scraper
-          token: ${{ secrets.CR_PAT }}
+      - name: Clone schwab-scraper
+        env:
+          CLONE_TOKEN: ${{ secrets.CRT_READ_ONLY }}
+        run: |
+          mkdir -p vendor
+          git clone --depth=1 --branch main \
+            "https://x-access-token:${CLONE_TOKEN}@gitea.ext.ben.io/b3nw/schwab-scraper.git" \
+            vendor/schwab-scraper
 
       - name: Login to Gitea Container Registry
         uses: docker/login-action@v2