ci: restore a scoped nSpect ID fallback for the Security Suite

Run 40634302555 resolved `vars.NSPECT_ID` to empty, so the suite preflight
failed and the malware scan was skipped: the ID was provisioned as an Actions
secret, and a reusable workflow's inputs cannot read the secrets context.

Restore the literal fallback so the pilot can keep running, but scope it with
`github.repository` this time, so a repository opting in through
CI_CUSTOMIZATIONS_SECURITY_SUITE_ENABLED gets an empty ID instead of reporting
against cuda-python's registration. Remove it once NSPECT_ID exists under
Settings -> Secrets and variables -> Actions -> Variables.

Author: gmanal

.github/workflows/security-suite.yml

@@ -52,10 +52,9 @@ jobs:
       secret-failure-policy: unverified
       # Same analysis the retired codeql.yml performed: python, build-mode none, security-extended.
       sast-languages: '["python"]'
-      # Must be a repository Actions variable, not a secret — a reusable workflow's inputs cannot
-      # read the secrets context. Empty degrades to an unregistered rapid scan: findings are still
-      # reported, but nothing is recorded against the nSpect program.
-      nspect-id: ${{ vars.NSPECT_ID }}
+      # NSPECT_ID must be an Actions *variable*: a reusable workflow's inputs cannot read secrets.
+      # Literal fallback until it is provisioned, scoped so no other caller inherits this registration.
+      nspect-id: ${{ vars.NSPECT_ID || (github.repository == 'NVIDIA/cuda-python' && 'NSPECT-ZY2K-Y1V8' || '') }}
       vuln-runs-on: linux-amd64-cpu4
       # report-only (default) — findings warn; fail-on-vulnerability — any finding fails. Errors always fail.
       vuln-failure-policy: report-only