Security hardening: add supply-chain gates

[senseibelbi]

Summary

• Add the repo-specific supply-chain security baseline for the ToxMCP hardening pass.
• Keep the PR source-first: no dist, generated schemas/resources, release artifacts, or unrelated dirty worktree changes are included.
• Add audit/SBOM/secret-scanning coverage without redesigning existing CI.

Files included

• .github/workflows/security.yml
• .gitleaks.toml

Files intentionally excluded

• Existing release-note/readme branch work, generated outputs, and unrelated source edits were excluded.

Local validation

• Workflow YAML parsed with Ruby YAML.load_file where present.
• .gitleaks.toml parsed with Python tomllib where present.

Known follow-ups

• Let GitHub Actions be the source of truth for full workflow execution.
• Address any CI-only tool-install or policy tuning issues in follow-up commits on this branch.