fix(ci): suppress false positive gitleaks finding in secrets-scan

[Pierozi]

Summary

• Gitleaks flags cargo-deny-0.18 (a cache key in a historical QA workflow commit) as a generic-api-key due to entropy — it is not a real secret
• The offending commit (4d9a296) is reachable from main via tag history, so history rewriting is not viable; adding .gitleaksignore is the correct suppression mechanism
• Pins the exact fingerprint so only this one finding is ignored, leaving future real leaks detectable

Test plan

• Re-run the Security Scan / secrets-scan workflow manually via workflow_dispatch and confirm it passes