feat: Add secret detection workflows and comprehensive benchmarking (#15)

Add three production-ready secret detection workflows with full benchmarking infrastructure:

**New Workflows:**
- gitleaks_detection: Pattern-based secret scanning (13/32 benchmark secrets)
- trufflehog_detection: Entropy-based detection with verification (1/32 benchmark secrets)
- llm_secret_detection: AI-powered semantic analysis (32/32 benchmark secrets - 100% recall)

**Benchmarking Infrastructure:**
- Ground truth dataset with 32 documented secrets (12 Easy, 10 Medium, 10 Hard)
- Automated comparison tools for precision/recall testing
- SARIF output format for all workflows
- Performance metrics and tool comparison reports

**Fixes:**
- Set gitleaks default to no_git=True for uploaded directories
- Update documentation with correct secret counts and workflow names
- Temporarily deactivate AI agent command
- Clean up deprecated test files and GitGuardian workflow

**Testing:**
All workflows verified on secret_detection_benchmark and vulnerable_app test projects.
Workers healthy and system fully functional.

backend/toolbox/modules/secret_detection/gitleaks.py

@@ -248,7 +248,8 @@ class GitleaksModule(BaseModule):
                 rule_id = result.get("RuleID", "unknown")
                 description = result.get("Description", "")
                 file_path = result.get("File", "")
-                line_number = result.get("LineNumber", 0)
+                line_number = result.get("StartLine", 0)  # Gitleaks outputs "StartLine", not "LineNumber"
+                line_end = result.get("EndLine", 0)
                 secret = result.get("Secret", "")
                 match_text = result.get("Match", "")
 
@@ -278,6 +279,7 @@ class GitleaksModule(BaseModule):
                     category="secret_leak",
                     file_path=file_path if file_path else None,
                     line_start=line_number if line_number > 0 else None,
+                    line_end=line_end if line_end > 0 else None,
                     code_snippet=match_text if match_text else secret,
                     recommendation=self._get_leak_recommendation(rule_id),
                     metadata={