Read the tarball host from a secret, not a variable

Run logs of a public repository are public, and Gitea prints variables in
them in clear text; only secrets are masked.

Claude-Session: https://claude.ai/code/session_01GGe7kUhooMFuzY6GaDb2w9

.gitea/workflows/aur-publish.yml

@@ -111,4 +111,4 @@ jobs:
           printf '%s\n' "$TARBALLZ_SSH_KEY" > ~/.ssh/tarballz
           chmod 600 ~/.ssh/tarballz
           ssh -i ~/.ssh/tarballz -o IdentitiesOnly=yes -o StrictHostKeyChecking=accept-new \
-            "${{ vars.TARBALLZ_TARGET }}" < aur-pkg/PKGBUILD
+            "${{ secrets.TARBALLZ_TARGET }}" < aur-pkg/PKGBUILD