ci: add gitleaks workflow for secret scanning

Scans on push, pull_request, and manual dispatch, with full git history (fetch-depth: 0) so a secret in an older commit is caught too.