Add secrets scanning workflow for PR checks

[kszarek]

Add required secrets scanning workflow that runs on pull requests to detect accidentally committed secrets.

Changes

• Added .github/workflows/secrets-scan-on-pr.yaml
• Uses detect-secrets-action to scan for secrets in PRs
• Runs on pull requests to main/master branches
• Required check for all PRs as per repository requirements

Testing

The workflow will automatically run on this PR to verify it works correctly.

In general, the problem is fixed by explicitly adding a permissions block to the workflow or to the specific job so that the GITHUB_TOKEN has only the minimum required access. Since this workflow only defines a single job that calls a reusable workflow, and we don’t know any need for write access from this file, we can safely restrict permissions to read-only for repository contents.

The best minimal change is to add a permissions block at the workflow (top) level, just under name: Secrets Scan. This will apply to all jobs in this workflow (including scan) unless they override permissions themselves. A conservative least-privilege choice is contents: read, which allows the reusable workflow to read repository contents while preventing write operations with the GITHUB_TOKEN from this workflow’s context.

Concretely, in .github/workflows/secrets-scan-on-pr.yaml, insert:

permissions:
  contents: read

between line 1 (name: Secrets Scan) and line 3 (on:). No additional imports, methods, or definitions are needed because this is purely a YAML configuration change.