add sast workflow

[0xcucumbersalad]

Summary by cubic

Adds a GitHub Actions SAST workflow to run Gitleaks on pull requests and pushes to main to prevent committed secrets. Previously we had no automated secret scanning; now the job scans PR ranges and full history where needed and fails on findings.

• Triggers on PRs and main pushes; cancels in‑progress runs per ref; 10‑minute timeout.
• Uses gitleaks/gitleaks-action@ff98106e4c7b2bc287b24eaf42907196329070c7 with actions/checkout@11d5960a326750d5838078e36cf38b85af677262 pinned to SHAs; checks out full history; requires pull-requests: read to scope scans to the PR range.
• Required: add a GITLEAKS_LICENSE secret for organization‑owned private repos (unused for personal or public repos). GITHUB_TOKEN is used by default.

^{Written for commit 0ba717c. Summary will update on new commits.}