chore: add Semgrep and Gitleaks checks

[a-know]

Summary

• add a tracked pre-commit hook that scans staged changes with Gitleaks and Semgrep
• add Dart/Flutter-focused Semgrep rules for hardcoded secrets, insecure hashes, and disabled TLS validation
• document local installation and hook setup

Verification

• validated the Semgrep configuration
• ran Semgrep against the repository
• ran Gitleaks against Git history
• ran the pre-commit hook against the staged changes