feat(ci): add rebar3-version input to elixir-ci-reusable (hex-cert bypass) (#415)

Optional rebar3-version input wired to setup-beam: installs rebar3 from
GitHub releases instead of builds.hex.pm (OTP TLS key_usage_mismatch).
Empty default = no change for existing callers. REQUIRED — bofig#107
already passes this input, so the reusable must declare it. actionlint
clean.

Author: hyperpolymath

.github/workflows/elixir-ci-reusable.yml

@@ -73,6 +73,15 @@ on:
         type: string
         required: false
         default: "1.17"
+      rebar3-version:
+        description: >-
+          rebar3 version for erlef/setup-beam. When set, setup-beam installs
+          rebar3 from GitHub releases instead of letting `mix local.rebar`
+          fetch it from builds.hex.pm — a workaround for the OTP TLS
+          `key_usage_mismatch` cert error on that host. Empty = unchanged.
+        type: string
+        required: false
+        default: ""
       enable_dialyzer:
         description: Run `mix dialyzer` (slow cold-cache; off by default)
         type: boolean
@@ -152,6 +161,7 @@ jobs:
         with:
           otp-version: ${{ inputs.otp-version }}
           elixir-version: ${{ inputs.elixir-version }}
+          rebar3-version: ${{ inputs.rebar3-version }}
 
       - name: Cache deps
         uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5