ci: use validated pip mirror for release gates

.github/workflows/build-test-quality-gate.yml

@@ -42,6 +42,8 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 25
     env:
+      PIP_INDEX_URL: https://pypi.tuna.tsinghua.edu.cn/simple
+      PIP_DISABLE_PIP_VERSION_CHECK: "1"
       CONTRACT_API_ENVIRONMENT: test
       CONTRACT_API_DATABASE_URL: "sqlite+pysqlite:///:memory:"
       CONTRACT_API_DATABASE_AUTO_CREATE: "true"

.github/workflows/security-quality-gate.yml

@@ -16,6 +16,9 @@ jobs:
     name: npm audit, Bandit, pip-audit, detect-secrets
     runs-on: ubuntu-latest
     timeout-minutes: 20
+    env:
+      PIP_INDEX_URL: https://pypi.tuna.tsinghua.edu.cn/simple
+      PIP_DISABLE_PIP_VERSION_CHECK: "1"
 
     steps:
       - name: Checkout