Keep git credentials in the GNOME keyring

Bazzite answered git's password prompts from KDE Wallet via ksshaskpass, which
Ubuntu won't have. Build git's libsecret helper (Ubuntu ships it as source only)
and point credential.helper at it, falling back to a week-long credential cache
if the build isn't possible. Note in the README that the first Gitea push has to
re-enter the password, since keyrings aren't in the backup.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

README.md

@@ -143,6 +143,9 @@ boot; if Podman says the device is unknown, run
   this width.
 - **PIA VPN:** the official Linux app works on Ubuntu (it couldn't on Bazzite's read-only
   `/usr`). Download the installer from PIA and run it.
+- **Gitea:** your first `git push` asks for your username and password (or token) once —
+  KDE Wallet was answering that for you here, and the GNOME keyring takes over on Ubuntu.
+  Keyrings aren't in the backup, so no other password comes across either.
 
 ## Coming from Bazzite: what moved