feat: default gitleaks arguments to avoid secret exposure See merge request to-be-continuous/gitleaks!52