added sast workflow

[0xcucumbersalad]

added sast workflow

---

Summary by cubic

Adds a GitHub Actions SAST workflow that runs gitleaks on all pull requests and on pushes to main to prevent secret leakage. Previously we had no automated secret scanning; now PRs can be blocked if secrets are detected, including in full history on push.

• Uses actions/checkout with fetch-depth: 0 to scan full history on push; scans PR commit range on pull_request.
• Runs gitleaks/gitleaks-action with a 10-minute timeout; third-party actions are pinned to a commit SHA.
• Sets minimal permissions (contents: read, pull-requests: read) and cancels in-progress runs per ref via concurrency.
• Required setup: For organization-owned repos, add a GITLEAKS_LICENSE secret (repository or org level). Public/personal repos do not require it.
• Expect CI failures if historical or rotated secrets exist; remove the secrets or update policy as needed before merging.

^{Written for commit bef5e07. Summary will update on new commits.}