fix: let the secret scan run for Dependabot (#385)

Closes #383.

`betterleaks` is a required status check, and the job excluded
Dependabot by actor name:

```yaml
github.actor != 'dependabot[bot]'
```

A required check that never reports does not merely go unreported — it
blocks the merge. Asked directly rather than read off
`mergeStateStatus`, the merge API says so in one line:

```
Repository rule violations found
Required status check "betterleaks" is expected.
```

So **every Dependabot pull request in every consumer of this repository
was unmergeable by construction**, with `--admin` the only way through —
which is precisely what a required check exists to prevent. Observed on
`netresearch/t3x-nr-browser-ai#51` and
`netresearch/t3x-nr-passkeys-be#120`; on a human-authored pull request
in the same repository minutes later, both `betterleaks` and `gitleaks /
Secret Scanning` report SUCCESS.

## Why removing the filter is safe

The exclusion was not compensating for anything. The job's permissions
are `contents: read` and `security-events: write`, and it reads no
`secrets.*` — so the usual reason to skip bot pull requests (no access
to repository secrets) does not apply here. `git log -S` places the line
in the initial org-wide workflow commit of 31 March, alongside
everything else, rather than in a change made in response to a problem.

The result is that bot dependency updates get scanned rather than
waived. That is strictly more coverage than today, not less.

## What this does not decide

Every repository checked runs **both** Dependabot and Renovate, and
their `dependabot.yml` covers `composer` and `github-actions` — both of
which Renovate also covers. In `t3x-nr-vault`, Renovate opened 5 of the
last 60 pull requests and Dependabot 0. So Dependabot may be redundant
in the repositories that have both, and retiring it there would remove
this class of problem rather than fix it.

That is a separate decision, and it is not uniform:
`netresearch/timetracker` has no `renovate.json` at all, so Dependabot
is its only updater. This change helps that case either way.

Author: CybotTM

.github/workflows/gitleaks.yml

@@ -34,10 +34,14 @@ jobs:
     name: Secret Scanning
     runs-on: ubuntu-latest
     timeout-minutes: 10
+    # Deliberately no actor filter. betterleaks is a required status check, and a
+    # required check that never reports blocks the merge -- excluding Dependabot
+    # here made every one of its pull requests unmergeable by construction
+    # (netresearch/.github#383). The job needs no secrets, so nothing stops it
+    # from running for a bot.
     if: >-
       !inputs.skip &&
-      github.event_name != 'merge_group' &&
-      github.actor != 'dependabot[bot]'
+      github.event_name != 'merge_group'
     permissions:
       contents: read
       security-events: write