Scan a diff in trufflehog, not the whole repo history (#47945)

The Secret Leaks job fails on any push that CREATES a branch, and passes
on every later push to it. The action derives its scan base from
github.event.before, which is all-zeros for a new branch, so trufflehog
walks the entire history instead of the pushed changes:

  new branch: scanning repo {"head": "..."}            415676 chunks, 230 MB
  later push: scanning repo {"base": "...", "head": ...}    11 chunks, 8 KB

The 230 MB scan reports 397 "verified" secrets, all from Lob's detector,
all false. That detector matches `(live|test)_<35 hex>` and verifies a hit
by POSTing to api.lob.com/v1/us_verifications, where 422 is taken to mean
"key is valid, body is bad" — the endpoint 422s on a bad body regardless
of the key, so every candidate string is "verified" and the job exits 183.

Pass an explicit base (falling back to the default branch when there is no
before-SHA) so a new branch is scanned against main, and exclude the lob
detector so a future full scan cannot resurrect the same 397 hits. Every
push is now a diff scan, which also drops ~2 min of CI per new branch.