feat(secretscan): support .gitsecrets-ignore file for false positives

Parse .gitsecrets-ignore file from commits to filter out known false positives during secret scanning. Matches entries by SHA-256 content hash (truncated to 16 chars) and pattern ID. Update push rejection message to guide users toward GitSecrets addon for managing ignored detections.

services/secretscan/secretscan.go

@@ -143,7 +143,10 @@ func formatBlockMessage(secrets []secretscan.DetectedSecret, repoName string) st
 	sb.WriteString("  2. Use environment variables or a secrets manager\n")
 	sb.WriteString("  3. Consider using GitCaddy Vault to securely store secrets\n")
 	sb.WriteString("\n")
-	sb.WriteString("If this is a false positive, contact your administrator.\n")
+	sb.WriteString("FALSE POSITIVE?\n")
+	sb.WriteString("  Use the GitSecrets addon to mark detections as false\n")
+	sb.WriteString("  positives. This creates a .gitsecrets-ignore file in\n")
+	sb.WriteString("  your repo that the server will respect on future pushes.\n")
 	sb.WriteString("═══════════════════════════════════════════════════════════\n")
 
 	return sb.String()