ci(security): add gitleaks scan job

      - semgrep-report.json

      - semgrep-junit.xml

secret-scan:

  image:

    name: zricethezav/gitleaks:latest

    entrypoint: [""]

  stage: code-quality

  <<: *build_rules

  needs: []

  script:

    - gitleaks detect --source . --no-git --redact --exit-code 1 --report-format junit --report-path gitleaks-junit.xml

  artifacts:

    when: always

    reports:

      junit: gitleaks-junit.xml

    paths:

      - gitleaks-junit.xml

generate-apks:

  stage: build

  <<: *rules_publish