Add rule .env.* to .gitignore

[paolosalvatori]

Motivation

Adds support for ignoring Python .env variant files that may contain local credentials, while still allowing a tracked .env.example template. This PR also introduces repository-level secret and workflow security checks so these issues are caught both locally and in CI.

Changes

• Added .env.* to the root .gitignore to ignore common local environment files such as .env.local and .env.dev
• Kept .env.example tracked by explicitly un-ignoring it
• Added a short comment clarifying that local environment files may contain credentials
• Added a root .pre-commit-config.yaml with zizmor and gitleaks hooks
• Added pre-commit to the development dependencies
• Added a GitHub Actions workflow to run pre-commit checks on pull requests and manual dispatch
• Hardened the new pre-commit workflow to satisfy zizmor by pinning actions and disabling credential persistence on checkout

[Copilot]

Copilot wasn't able to review any files in this pull request.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[paolosalvatori]

@DrisDary please approve the PR and take it from it with @purcell, thanks 🙏