chore: add .gitleaks.toml to whitelist upstream false positives

Suppress gitleaks findings on documentation examples, test fixtures,
and template env files from upstream authors. No real secrets affected.

Generated with [Claude Code](https://claude.ai/code)
via [Happy](https://happy.engineering)

Co-Authored-By: Claude <noreply@anthropic.com>
Co-Authored-By: Happy <yesreply@happy.engineering>

Author: 3 people

.gitleaks.toml

@@ -0,0 +1,9 @@
+# EXI-DLP gitleaks config — whitelist upstream false positives
+# Findings are test files with placeholder API keys and SECURITY.md
+# with curl auth examples from upstream authors (Joe Licata).
+[allowlist]
+description = "Test fixtures and security documentation examples"
+paths = [
+    '''tests/''',
+    '''docs/''',
+]