added gitleaks workflow

[0xcucumbersalad]

added gitleaks workflow

---

Summary by cubic

Adds a GitHub Actions SAST workflow that runs Gitleaks on all pull requests and pushes to main to prevent secret leaks. The new behavior fails the check when secrets are detected, including rotated-but-committed secrets due to full-history scans.

Rollout notes

• Triggers on pull_request and push to main; 10-minute job timeout.
• Uses pinned actions/checkout (with fetch-depth: 0) and pinned gitleaks/gitleaks-action.
• Minimal permissions; includes pull-requests: read so PR-range scanning works.
• Concurrency cancels in-progress runs for the same ref.
• Required: Add a GITLEAKS_LICENSE secret for organization-owned repos (not needed for personal or public repos).

^{Written for commit 006e3cd. Summary will update on new commits.}