S-125938: Add gitleaks secret scanning

[EllAchE]

Summary

• Add a pinned Gitleaks workflow and default configuration so pull requests and default-branch pushes receive secret scanning.
• Load scanner configuration from the base branch during pull-request scans, preventing the change under review from weakening its own check.

Test plan

• Validate the workflow with Prettier
• Review the gitleaks configuration and workflow diff

Part of S-125938

Agent Audit

• Action: create-pr
• Timestamp: 2026-07-21T20:18:15Z
• Agent: codex
• Agent type: codex
• Triggered by: loganharless
• Origin: loganharless@dev-vm
• Session: 019f8643-2ab0-7112-99cd-19471a75612b
• Source repo: usestring/utils
• Worktree: /home/loganharless/worktrees/s-125938-usestring-repos/utils
• Branch: s-125938-gitleaks-husky-20260721
• Head commit: 4e03a9b
• tmux pane: %8
• tmux session: cdx-3124802-79