gitleaks git-history secret scan

Scans the full git history (all refs, newest settings["code.secrets-history"].maxCommits, default 5000) with gitleaks for secrets that were committed and later removed. The repository is first copied into a bare mirror in a temp dir and scanned there with git config, hooks, attributes and textconv/fsmonitor drivers neutralised, so a hostile .git/config cannot execute code. Repositories whose git data reaches outside the target (an outside gitfile or commondir, alternates, symlinks in .git) are refused; replace refs, grafts and hidden refs cannot hide commits, and shallow or truncated history is reported as incomplete. The target's own .gitleaks.toml, .gitleaksignore and inline gitleaks:allow comments are deliberately ignored (a repository must not be able to allow-list its own leaks); gitleaks' built-in rules apply. Slow on large histories, so opt-in.