feat: integrate Gitleaks for secret detection and prevention

[MatiasOS]

Description

Integrate Gitleaks to detect hardcoded secrets, API keys, tokens, and credentials before they reach the repository.

Part of the Quality Tooling Rollout (#369).

Tasks

• Set up Gitleaks in CI via GitHub Actions (official gitleaks/gitleaks-action)
• Add Gitleaks as a pre-commit hook to catch secrets before commit
• Configure .gitleaks.toml with custom allowlist rules for:
  • Test fixtures and mock data
  • Example .env templates
  • Known false positives
• Run initial full-history scan to detect any existing leaked secrets
• Add PR annotations for detected secrets
• Add Gitleaks badge to README

Motivation

A blockchain explorer handles RPC URLs, API keys, and potentially wallet-related configuration. Secret leaks are critical. Gitleaks:

• Prevents accidental credential commits (pre-commit + CI)
• Scans full git history for past leaks
• Detects 150+ secret types out of the box (AWS, GitHub tokens, private keys, etc.)

Notes

• Pre-commit hook via lefthook or husky to catch secrets locally.
• CI should block PRs on any detection (high signal, low false positives).
• After initial history scan, rotate any exposed credentials immediately.