ci: add secret scanning

[zgeoff]

Adds the org secret scanning workflow, calling the reusable gitleaks scan in pipelabs/tooling, per the secrets hygiene guideline. It scans commits introduced by PRs and pushes, not existing history. After merge, secret-scan / gitleaks becomes a required status check on main, which also means direct pushes to that branch will be blocked in favour of PRs.

[cursor]

PR Summary

Low Risk
CI-only change with no runtime or application code; it adds automated secret detection and may block merges until the new check is configured and passing.

Overview
Adds a Security GitHub Actions workflow that runs gitleaks secret scanning via the reusable pipelabs/tooling/.github/workflows/secret-scan.yml@main job.

It runs on pull requests and pushes to main, scanning only new commits in those events (not full repo history). After merge, secret-scan / gitleaks is intended to be a required status check on main, which blocks merges (and direct pushes) until the scan passes.

^{Reviewed by Cursor Bugbot for commit 002f3f5. Configure here.}