CI: fix Security workflow (pip-audit pip upgrade, gitleaks via OSS CLI)

pip-audit: upgrade pip so the runner toolchain is not flagged. gitleaks: the gitleaks-action requires a paid license for org repos; use the open-source CLI (v8.30.1) to scan git history instead.

Author: Berik Ashimov

.github/workflows/security.yml

@@ -41,7 +41,9 @@ jobs:
       - uses: actions/setup-python@v5
         with:
           python-version: "3.13"
-      - run: pip install pip-audit
+      # Upgrade pip first so the runner's own pip version is not flagged
+      # (the audit targets the project's dependency tree, not the toolchain).
+      - run: pip install --upgrade pip pip-audit
       - run: pip-audit --strict
 
   gitleaks:
@@ -51,7 +53,12 @@ jobs:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
-      - uses: gitleaks/gitleaks-action@v2
+      # Use the gitleaks CLI directly: the gitleaks-action requires a paid
+      # license for organization repositories, the open-source CLI does not.
+      - name: Install gitleaks
+        run: curl -sSL https://github.com/gitleaks/gitleaks/releases/download/v8.30.1/gitleaks_8.30.1_linux_x64.tar.gz | tar -xz -C /usr/local/bin gitleaks
+      - name: Scan git history for secrets
+        run: gitleaks git . --redact --verbose
 
   codeql:
     name: CodeQL (semantic SAST)