Fixing gitspiegel trigger workflow (#215)

The first attept to use a workflow to protect GitLab CI from untrusted
contributors failed, because GitHub doesn't pass secrets to workflows
for PRs that originate from forks.
 
This uses a different approach: instead of triggerring gitspiegel API
directly from the workflow, we're just spawning an empty workflow with a
specific path, and gitspiegel listens for `workflow_run` event to start
mirroring.

The idea is the same: for the first-time contributors, running workflows
would require manual aciton and that would block mirroring. But this
time, we don't need any secrets to make it work.