gitleaks config: default rules plus one allowlist entry, the sample Idempotency-Key in the chained-job-file tools.run-request fixture (generic-api-key took it for a key; CI's secrets job has been red since v0.33.0)

ddiff --git a/.gitleaks.toml b/.gitleaks.toml
nnew file mode 100644
iindex 00000000..9b2d8834
---- /dev/null
++++ b/.gitleaks.toml
@@@ -0,0 +1,11 @@
++# gitleaks configuration, used by the shared security workflow
++# (OpenVibers/OpenVibe.Shared/.github/workflows/security.yml). The default rules stay on; every
++# allowlist below is one proven false positive, matched on path AND value so nothing else is hidden.
++[extend]
++useDefault = true
++
++[[allowlists]]
++description = "Sample Idempotency-Key value in a tools.run-request@1 fixture; an idempotency key is a caller-chosen dedupe token, not a secret"
++condition = "AND"
++paths = ['''^fixtures/tools\.run-request/valid/chained-job-file\.json$''']
++regexes = ['''^resize-01JAB2C3$''']