ci(gitleaks): allowlist test fixtures (BIP32 public vectors, not secrets)

The full-history gitleaks scan flagged 3 generic-api-key matches, all false
positives in upstream 2017-2018 test fixtures: tests/wallet/test_bip32.py
(standard BIP32 public test vectors) and tests/lib/test_addresses.py (a
TokenPay test address constant). Allowlist tests/ paths. Verified locally:
1771 commits scanned, no leaks found, exit 0. Scan stays blocking on real
(non-test) secrets.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: TheArtofSatoshi

.gitleaks.toml

@@ -18,6 +18,10 @@ paths = [
   '''(^|/)README\.md$''',
   '''(^|/)WEBSOCKET_VERIFICATION\.md$''',
   '''docs/.*\.(md|rst)$''',
+  # Test fixtures are not real secrets: BIP32 public test vectors
+  # (tests/wallet/test_bip32.py) + a TokenPay test address constant
+  # (tests/lib/test_addresses.py), inherited from upstream 2017-2018 history.
+  '''(^|/)tests/''',
 ]
 regexes = [
   '''dockeruser''',