feat: add Gitleaks config and CI workflow

[stevefulme1]

Summary

• Adds .gitleaks.toml with default rules extended by custom Ansible-specific credential detection patterns (OpenShift API keys, Automation Hub tokens, container registry passwords)
• Configures allowlists for placeholder values (changeme), Jinja2 template variables ({{ }}), Ansible Vault references, example domains, and YAML comments
• Adds path-based allowlists for defaults/main.yml and inventory.yml where variable declarations use block scalar indicators
• Adds .github/workflows/gitleaks.yml GitHub Actions workflow to run Gitleaks on pushes to main and all PRs
• Complements the existing Gitleaks pre-commit hook in .pre-commit-config.yaml

Related

• Resolves: MFG-376

Test plan

• Verify gitleaks detect --config .gitleaks.toml --no-git reports no false positives on the current codebase
• Verify the GitHub Actions workflow triggers on PR creation
• Test that a commit containing a real secret (e.g., a test API key) is detected and flagged
• Confirm pre-commit hook still works with the new config file

🤖 Generated with Claude Code

[sabre1041]

@luizfao @jeffcpullen Would you be able to review the content of this PR?

[jeffcpullen]

Not an expert it GitHub actions or Gitleaks, but it looks like what I would expect to see. I appreciate the carve out on specific files with specific criteria "changeme" password placeholders. Going to let this run to review the output.

[jeffcpullen]

Ok, the run failed with 11 false positives.

10 of the 11 were looking at README.md files that do not contain secrets, but instead are documenting variables. For example, this line triggered Gitleaks.

<b>vm_ssh_openshift_api_key:</b> OpenShift API Key

The last one triggered the 'create_mf_aap_token_openshift_api_key' variable becuase it uses a multi-line YAML format.

    - name: Set fact with Service Account API key
      ansible.builtin.set_fact:
        create_mf_aap_token_openshift_api_key: >-
          "{{ create_mf_aap_token_migration_factory_aap_sa_token.resources[0].data.token | b64decode }}"
      no_log: "{{ create_mf_aap_token_secure_logging }}"