chore(security): add .gitleaks.toml to allowlist test fixtures and PEM header constants

Gitleaks correctly detects dummy API keys in test fixtures and PEM
header strings in sshAgent.ts, but these are intentional: test
fixtures use fake secrets for security testing, and sshAgent.ts
uses PEM headers as format detection constants (not actual keys).

Signed-off-by: Null;Variant <null@nullvariant.com>

🖥️ IDE: [VS Code](https://code.visualstudio.com/)
🔌 Extension: [Claude Code](https://claude.ai/download)

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Model-Raw: claude-opus-4-6

Author: nullvariant

.gitleaks.toml

@@ -0,0 +1,10 @@
+[extend]
+useDefault = true
+
+[[allowlist.paths]]
+description = "Test fixtures contain intentional dummy secrets for security testing"
+regex = '''src/test/'''
+
+[[allowlist.paths]]
+description = "SSH key format detection uses PEM header strings as constants"
+regex = '''src/sshAgent\.ts'''