ci(secu): stop gitleaks job failing on rate limits

[sc979]

Description

What are your needs or what are you planning to do in this PR?

ci(secu): stop gitleaks job failing on rate limits

Two changes to .github/workflows/gitleaks-analysis.yml.

1. Check out with plain git: the job downloads no action

Concurrent scans on the self-hosted runners share one egress. When the runner downloads
actions/checkout at "Set up job", codeload.github.com can answer
429 Too Many Requests: the job fails before any step runs and raises a secret scan alert
(e.g. centreon-cloud-apps run 38580027651, attempt 1).

The Checkout Repository step now runs git directly, with the same clone as before:

Event	Clone	Checked out
pull_request	fetch-depth = PR commits + 2 (PR commits, merge and base commits)	merge commit, detached
workflow_dispatch	full history, all branches and tags	dispatched commit, detached (live branch tip if it was force-pushed away)

• Workspace: emptied first, like the default clean of actions/checkout.
• Retries: each fetch is retried 3 times.
• Token: the job token goes through env-scoped git config, as in the scan's
  re-fetches. It is never written to .git/config and is masked in the logs.
• Removed step: Compute fetch depth, since the checkout computes the depth itself.

2. Use the runner's gitleaks on the centreon self-hosted runners

Runner	Behaviour
centreon-ubuntu-26.04-* (private and internal centreon repositories)	Uses the shipped gitleaks, without checking its version: the runner image team owns it. Fails the job if the binary is missing.
quanta-security	Does not ship gitleaks yet (MON-212266): installs it like a public runner.
ubuntu-26.04 (public repositories)	Unchanged: resolves the version, downloads it and verifies its checksum.

The runner criterion is the same as the centreon branch of runs-on.

Tests

Each step was run locally, extracted verbatim from the workflow:

Case	Result
PR centreon-cloud-apps#2760 (private), runner shipping gitleaks	Merge commit checked out, workspace emptied, no token in .git/config, runner binary used, 4 commits scanned
PR centreon#12022 (base 32 commits ahead)	Checkout and scan OK
workflow_dispatch on security-tools main	Full, non-shallow clone, 51 commits scanned
Runner expected to ship gitleaks, binary missing	::error::, exit 1
Public or quanta-security runner	gitleaks 8.30.1 downloaded, checksum OK

Not yet run on a real runner: to validate on a private repository (self-hosted runner) and
on a public one (ubuntu-26.04) before merging.

Not in scope

dependency-analysis.yml still uses actions/checkout on the same runners, so it can hit
the same 429 at "Set up job".

🤖 Generated with Claude Code