ci(security): retry gitleaks download to survive transient 5xx

The Install Gitleaks step piped curl directly into tar. A transient 504
from the GitHub release CDN truncated the stream and failed the security
gate with exit 2, despite no actual secrets. Download to a file with
curl --retry/--retry-all-errors first, then extract, so a flaky download
recovers instead of blocking the PR.

Author: gonzalesedwin1123

.github/workflows/security.yml

@@ -30,8 +30,12 @@ jobs:
         run: |
           GITLEAKS_VERSION="8.21.2"
           mkdir -p "$HOME/.local/bin"
-          curl -sSfL "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" \
-            | tar -xz -C "$HOME/.local/bin" gitleaks
+          # Download to a file (not a pipe) with retries so a transient 5xx
+          # from the release CDN doesn't fail the whole security gate.
+          curl -sSfL --retry 5 --retry-all-errors --retry-delay 3 \
+            -o /tmp/gitleaks.tar.gz \
+            "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz"
+          tar -xz -C "$HOME/.local/bin" gitleaks < /tmp/gitleaks.tar.gz
           echo "$HOME/.local/bin" >> "$GITHUB_PATH"
 
       - name: Run Gitleaks