Add security GHA shim (gitleaks + Dependabot SLA gate)

[jlocke2]

Fleet rollout of the shared security gate (pipeline_deals #18557 / #18559). Thin shim calling the org-wide reusable security-reusable.yml.

• gitleaks — secret-scans the PR diff.
• dependency-audit — Dependabot-alert SLA gate: blocks only once an alert is past its remediation SLA (crit/high 30d, med 60d, low 90d), all ecosystems; fail-closed via the org App token.

After merge + green, security / gitleaks + security / dependency-audit get added to required checks.

🤖 Generated with Claude Code

[jlocke2]

Parking this: this repo is public, and a public repo cannot call a reusable workflow in a private repo (pipeline_deals), so the shim startup-fails to resolve security-reusable.yml@master. (Same root cause is currently breaking claude-review here too.)

Tracked as a follow-up — the fix is either making the repo private/internal or giving it a standalone (inlined) security workflow. Closing until that decision.