Pin gitleaks version as a single pipeline variable in azure-pipelines.yml

[johnmccrae]

Context

azure-pipelines.yml has the gitleaks version (8.30.1) hardcoded in two places — the winget install command on Windows and implicitly in the Linux apt install. When gitleaks releases a new version the file must be updated in multiple spots, risking drift.

Acceptance Criteria

• Gitleaks version extracted to a single pipeline variable (e.g. GITLEAKS_VERSION: '8.30.1') at the top of azure-pipelines.yml
• Both Windows and Linux install steps reference the variable
• Verified the pipeline still passes after the change

Relevant Code Paths

• azure-pipelines.yml — Windows install step (~line 18) and Linux install step (~line 30)