added gitleaks workflow

[0xcucumbersalad]

added gitleaks workflow

---

Summary by cubic

Adds a SAST GitHub Actions workflow that runs gitleaks/gitleaks-action on PRs and pushes to main to block leaked secrets. Previously we had no automated secret scanning; now findings fail the check and can gate merges.

• Triggers on pull_request and on pushes to main; cancels in-progress runs per ref.
• Scans PR commits on PRs; scans full history on pushes (fetch-depth: 0) to catch rotated-but-committed secrets.
• Uses pinned SHAs and least-privilege permissions, including pull-requests: read for PR commit access.
• Required: For organization-owned repos, add a GITLEAKS_LICENSE secret (repo or org level); the job also uses GITHUB_TOKEN.
• If the check fails, remove the secret from history and rotate the credential before merging.

^{Written for commit 5bdf438. Summary will update on new commits.}