ci: add secret scanning workflow

[AtilaVG]

What does this PR do

This PR adds a dedicated secret scanning workflow using Gitleaks.

It also keeps the redaction tests free from complete token-shaped literals, so secret scanners do not flag fake test fixtures as leaked credentials.

Why

Athen handles provider keys, GitHub identities, Telegram settings, email credentials, web-search keys, and other sensitive configuration.

Adding a lightweight secret scanning check helps catch accidentally committed credentials early, before they reach main.

Changes

• Add .github/workflows/secret-scan.yml.
• Run Gitleaks on pushes and pull requests targeting main.
• Use read-only repository permissions.
• Keep checkout history available with fetch-depth: 0.
• Adjust redaction test fixtures so they build token-like strings at runtime instead of storing complete fake token-shaped literals.

Scope

• No runtime behavior changed.
• No application code path changed.
• No redaction behavior changed.
• CI-only hardening plus test fixture cleanup.

Notes

This PR intentionally does not add a custom allowlist yet. If Gitleaks reports legitimate false positives, they should be reviewed individually and allowlisted narrowly rather than broadly disabling rules.