ci: switch SDK to git dep, inject MODULE_SDK_PAT via insteadOf

Two prior approaches failed:

1. Sibling-clone of module-sdk into a directory two levels up
   from $GITHUB_WORKSPACE failed with a 2-second runner failure
   (bisect confirmed: workflow with ONLY the own-repo checkout
   succeeded; adding the sibling-clone step reproduced the
   failure).

2. Anonymous clone of the now-public module-sdk also failed —
   the Forgejo instance has REQUIRE_SIGNIN_VIEW=true, so making
   a repo public does not enable anonymous read.

The working approach: switch fai-module-sdk to a git dependency
in Cargo.toml and inject a stored Forgejo PAT into any outgoing
git.flemming.ws URL via 'git config url.X.insteadOf Y'. Cargo's
git fetch (driven by CARGO_NET_GIT_FETCH_WITH_CLI=true) then
authenticates transparently.

The Forgejo Actions secret MODULE_SDK_PAT carries the read token.
Locally, the same insteadOf trick works via GIT_CONFIG_COUNT
without polluting the global git config.

Bumps text-extract 0.1.4 -> 0.1.5.

Signed-off-by: flemming-it <sf@flemming.it>

Cargo.toml

@@ -5,7 +5,7 @@
 
 [package]
 name = "text_extract"
-version = "0.1.4"
+version = "0.1.5"
 edition = "2024"
 authors = ["Dr. Stefan Flemming <platform@flemming.ai>"]
 license = "Apache-2.0"
@@ -18,7 +18,7 @@ rust-version = "1.85"
 crate-type = ["cdylib", "rlib"]
 
 [dependencies]
-fai-module-sdk = { path = "../../module_sdk/crates/fai-module-sdk" }
+fai-module-sdk = { git = "https://git.flemming.ws/fai/module-sdk.git", branch = "main" }
 serde = { version = "1", features = ["derive"] }
 pdf-extract = "0.7"
 zip = { version = "2", default-features = false, features = ["deflate"] }