Add centralized Gitleaks config delivery

[rtrofimenkov-ssdlc]

What

Implements centralized Gitleaks configuration distribution for GitHub Actions, enabling consistent secret scanning rules across all repositories without config duplication.

Changes

• Add gitleaks/config/gitleaks.base.toml with base rules
• Copy centralized config to ${RUNNER_TEMP}/gitleaks.base.toml during action execution (safe for Werf/giterminism)
• Update config detection logic to use centralized config by default
• Support local .gitleaks.toml for repository-specific customization via [extend] mechanism

How it works

1. Action copies base config from modules-actions to ${RUNNER_TEMP}/gitleaks.base.toml
2. If local .gitleaks.toml exists → uses it (should extend base config via [extend])
3. Otherwise → uses centralized config directly
4. Config is stored outside git working directory (Werf-safe, no dirty state)
5. If local .gitleaks.toml exists without [extend] section > prints warning, ignores local config and uses base one.

Benefits

• ✅ Centralized rule management across all repos
• ✅ No config duplication in consumer repositories
• ✅ Safe for Werf (config outside working directory, no giterminism issues)
• ✅ Flexible: supports both centralized-only and extended configs
• ✅ Automatic updates: repos get new rules when action version is updated
• ✅ Repository-specific rules still possible via local .gitleaks.toml

Testing

Tested:

• ✅ Scenario 1: No local config (uses centralized only)
• ✅ Scenario 2: Local config with [extend]
• ✅ Scenario 3: Local config without [extend]