ci: skip flaky live-network gitleaks test with -short

[franzer]

Summary

Adds -short to the CI go test invocation so the gitleaks binary-download tests, which hit the live GitHub API, are skipped in CI. These flake with HTTP 403 on shared runners due to anonymous rate limiting.

Related Issue

The Go Tests job intermittently fails on TestBinaryManager_Download_Latest with GitHub API returned HTTP 403. Most recently on the main merge of #26.

Type of Change

• Bug fix (non-breaking change which fixes an issue)

Motivation

TestBinaryManager_Download_Latest and TestBinaryManager_Download resolve the latest gitleaks release via an unauthenticated GitHub API call. Shared CI runner IPs hit GitHub's 60-request/hour anonymous rate limit and get a 403, failing the job through no fault of the change under test. Both tests already guard with testing.Short(), but the CI command was not passing -short, so the guard never fired.

Changes

• .github/workflows/test.yml: add -short to the go test command for internal packages, with a comment explaining why. The real download path remains covered by the integration suite.

Testing

• Unit Tests (go test ./...)
• Manual Verification (describe below)

Measured coverage locally with -short: 55.3%, above the 50% gate (down from 57.6% full, since the two download tests are skipped). Confirmed the full internal suite passes with -short -race.

Checklist

• My code follows the style guidelines of this project
• I have performed a self-review of my own code
• My changes generate no new lint errors
• New and existing unit tests pass locally with my changes
• Test coverage meets the required threshold (50%)

Note

v1.0.3 already released successfully (GoReleaser does not run this test job), so no re-tag is needed. This just makes main green again and stops the flake recurring.