fix: tune gitleaks aws-account-id rule and clear security:secrets failures

[krokoko]

Problem

mise run security fails at security:secrets with 53 gitleaks findings after the custom aws-account-id rule landed in f57b931.

Acceptance criteria

• mise run security:secrets passes (0 leaks)
• False positives allowlisted: mise-action SHA pins, threat-composer artifacts, test fixtures, placeholder UUIDs
• Real account IDs removed from current source files (e.g. drawio diagrams)
• Historical remediated leaks baselined via .gitleaksignore where history cannot be rewritten

[krokoko]

Starting implementation on branch fix/313-gitleaks-aws-account-id.