added gitleaks workflow

[0xcucumbersalad]

added gitleaks workflow

---

Summary by cubic

Adds a SAST GitHub Actions workflow that runs gitleaks on pushes to main and on pull requests, failing CI when secrets are detected. This enforces secret scanning on PR ranges and uses full history checkout to catch previously committed or rotated secrets.

Review and rollout

• Adds .github/workflows/sast.yml with job “Gitleaks (secret history)” using actions/checkout (full history) and gitleaks/gitleaks-action, both pinned to SHAs.
• Triggers on pull_request and push to main; uses concurrency group sast-${{ github.ref }} to cancel redundant runs; 10-minute timeout.
• Uses minimal permissions: contents: read and pull-requests: read for PR commit access.
• Required for org-owned/private repos: add a repo/org secret GITLEAKS_LICENSE (Settings > Secrets and variables > Actions). The job also uses GITHUB_TOKEN.
• CI-only change; no runtime/app behavior changes.

^{Written for commit 0a37d20. Summary will update on new commits.}