Add gitleaks scan workflow

[BreakableHoodie]

Summary

• add a gitleaks workflow that scans every push, pull request, and a weekly cron for leaked secrets
• supply the GitHub token and organization gitleaks license so the action can authenticate, validate the license, and share results

Background

This site did not have automated secret scanning before. Adding gitleaks provides an early warning if API keys or other credentials are committed. The schedule gives us a regular check even if the repo is quiet, aligning it with the rest of the CivicTechWR portfolio.

Testing

• not run (workflow only)

@CivicTechWR/organizers please review.