chore(security): exclude test/dev paths from secret scanning (#4584)

.github/secret_scanning.yml

@@ -0,0 +1,14 @@
+# GitHub secret scanning path exclusions.
+# Secrets detected under these paths are auto-closed as "ignored by
+# configuration" and are not blocked by push protection.
+#
+# Deliberately NOT excluded: production source files (e.g. rustfs/src/**,
+# crates/*/src/**) even when a hit sits inside a #[cfg(test)] module or a
+# doc-comment example — excluding the file would also stop scanning the
+# production code in it. Close those alerts manually as "used in tests".
+paths-ignore:
+  - "crates/e2e_test/**" # dedicated e2e test crate, test credentials throughout
+  - "**/tests/**" # Rust integration-test dirs (crates/*/tests, rustfs/tests)
+  - "**/benches/**" # benchmark harnesses
+  - ".docker/**" # local docker-compose dev configs (e.g. mqtt vm.args cookie)
+  - ".vscode/**" # local editor launch configs