Adopt OCSentinel script layout and add Gitea workflow

scripts/protect-ocsentinel-secret.ps1

@@ -0,0 +1,25 @@
+param(
+    [Parameter(Mandatory)]
+    [string]$SecretValue,
+    [string]$OutputPath = "C:\ProgramData\OCSentinel\secrets\ocsentinel-upload-secret.dat"
+)
+
+$ErrorActionPreference = "Stop"
+
+Add-Type -AssemblyName System.Security
+
+$outputFullPath = [System.IO.Path]::GetFullPath($OutputPath)
+$outputDirectory = Split-Path -Parent $outputFullPath
+if (-not [string]::IsNullOrWhiteSpace($outputDirectory)) {
+    New-Item -ItemType Directory -Force -Path $outputDirectory | Out-Null
+}
+
+$secretBytes = [System.Text.Encoding]::UTF8.GetBytes($SecretValue)
+$protectedBytes = [System.Security.Cryptography.ProtectedData]::Protect(
+    $secretBytes,
+    $null,
+    [System.Security.Cryptography.DataProtectionScope]::LocalMachine
+)
+
+[System.IO.File]::WriteAllBytes($outputFullPath, $protectedBytes)
+Write-Host "Protected secret written to $outputFullPath"