fix(ci): retry the gitleaks download in Secret Scan (transient curl-56 blocks PRs) (#12)

The Secret Scan workflow downloaded the pinned gitleaks binary with a bare
`curl -sSfL` (no retry). A transient network blip (curl exit 56 — recv failure)
on the GitHub-releases fetch fails the whole scan and BLOCKS the PR even though
no secret exists. Adds --retry 5 --retry-delay 3 --retry-all-errors
--connect-timeout 15; the SHA256 verification below is unchanged, so retrying is
supply-chain-safe. Fleet propagation of KH#1351.

Co-authored-by: cloudingenium-automation[bot] <cloudingenium-automation[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: cloudingenium-automation[bot]

.github/workflows/secret-scan.yml

@@ -45,7 +45,7 @@ jobs:
           GITLEAKS_SHA256: "551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb"
         run: |
           mkdir -p "$HOME/.local/bin"
-          curl -sSfL -o /tmp/gitleaks.tar.gz \
+          curl -sSfL --retry 5 --retry-delay 3 --retry-all-errors --connect-timeout 15 -o /tmp/gitleaks.tar.gz \
             "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz"
           echo "${GITLEAKS_SHA256}  /tmp/gitleaks.tar.gz" | sha256sum -c -
           tar xzf /tmp/gitleaks.tar.gz -C "$HOME/.local/bin" gitleaks