ci: scan only the PR's own commits for secrets #7

What and why

The gitleaks step in every repo's PR checks fails pull requests over commits that are not in them. actions/checkout with fetch-depth: 0 fetches every branch, and gitleaks detect with no --log-opts runs git log --full-history --all, so each PR run scans every branch in the repo. A finding on one branch fails every other open PR.

Two findings on in-flight branches currently fail every PR:

• cryptos: commit 37897e3 on feat/284-protocol-switches (internal/config/protocols_test.go:30)
• docs: commit 073a3c8 on docs/20-reference-pages (docs/reference/root-cert-profile.md:21)

Scope

• PR runs: scan only the PR's own commits, base.sha..head.sha from the pull_request event (--log-opts).
• cryptos push runs: its separate Gitleaks workflow also runs on every push. A push to main keeps a full-history scan, but of main only (it holds only merged commits), not --all. A push to any other branch scans that branch's commits not yet on main.
• docs, api, manager, web and helm have no push-time scan, so only the PR step changes there.
• gitleaks stays the pinned 8.30.0 binary. Nothing else in the workflows changes.

One PR per repo (cryptos, docs, api, manager, web, helm), each saying Refs CryptOS-PKI/.github#<this issue>.

Done when

• The six PRs are merged.
• A clean PR passes the scan, and a secret added in a PR's own commit still fails it (shown in each PR).