feat: add lefthook pre-commit hook with gitleaks secret scanning

[panish16]

Part of the Git Hooks RFC rollout (bcgov/entity#34619).

Adds a pre-commit hook that runs gitleaks on staged changes.

• lefthook.yml - secret scan only via npx gitleaks-secret-scanner
• package.json - lefthook dev dependency only. No prepare script needed: lefthook's own npm postinstall installs the hook.
• package-lock.json - only the 11 lefthook entries added (165 lines, 0 removed). npm install -D also wanted to prune/re-flag unrelated entries - all left out on purpose. Checked: npm ci accepts it (lock in sync).
• .gitleaks.toml - gitleaks default rules plus narrow allowlists for false positives found by scanning the whole repo:
  • lockfiles + this config
  • docs/assets/ - generated Storybook build output (npm run build-storybook). The minified bundle contains the Genesys deploymentKey from the stories, so without this every docs rebuild would be blocked
  • Still flagged on purpose: the two deploymentKey lines in GenesysWebMessage.stories.ts (public widget ids, but left visible rather than blanket-allowlisting a key name). Hook only checks changed lines, so no impact unless edited.

To get the hook: Run npm install (or npm ci) once.

Build safety: lefthook's postinstall skips itself when CI is set (GitHub Actions), and otherwise never fails the install - it runs lefthook install in a try/catch via spawnSync. Checked by installing the way the Dockerfile does (only package*.json, no .git): lefthook install itself errors (not a git repository, exit 1) but npm ci still exits 0. Same with no git binary at all.

Tested

Windows, real git commit:

• npm ci → exit 0, hook installed by lefthook's postinstall
• fake GitHub token at root and in src/ → blocked
• clean change → commit fine