Add secrets extra-config seam and commit-message scanning

[cgraf78]

Summary

Extends the secrets phase so an environment extension can contribute
additional gitleaks rulesets, and so commit messages are scanned — not
just staged file content. This lets an overlay enforce, e.g., that
work-specific vocabulary never lands in a public repo, using the same
gitleaks engine and the existing commit gate.

• add the _sley_hook_secrets_extra_configs extension hook (default
  none). The secrets scan runs one independent gitleaks pass per returned
  config over the same staged + worktree inputs, MAX-preserving the exit
  code so a later leak (rc 1) can never mask a scanner error (rc >= 2).
• add sley secrets --message-file <path>, which scans a commit message
  through the base config plus the extra configs. Only the commit -v
  scissors region is removed; # comment lines are deliberately kept,
  because Git's non-interactive cleanup (-m/-F, and the message a
  commit-msg hook receives) is whitespace and commits them verbatim —
  stripping them would be a fail-open.
• findings are run with --verbose so a redacted match still names its
  RuleID, which matters for vocabulary rules.

Base sley ships no extra configs, so behavior is unchanged unless an
extension opts in.

Testing

• test/sley-test: 498 (behavior) passed, 0 failed; full suite exit 0
• shellcheck clean on lib/sley/sley.sh, lib/sley/hooks.sh, and the suite
• new cases cover: extra-config blocks (staged + worktree + message),
  no-extension no-op, base-config message finding, scanner-error rc>=2
  dominating a later leak in the message path, message comment retained
  (no fail-open) while the scissors region is cut, and usage errors