Report unused gitleaks ignore entries

Is your feature request related to a problem? Please describe. Gitleaks ignore files can drift out of sync with the code they were created for. When a file moves or lines change, existing .gitleaksignore entries can silently become stale, and there is no built-in way to tell whether an ignore still matches a current finding. This makes it hard to keep suppressions accurate and to notice when an ignore is no longer matching/needed.

Describe the solution you'd like Add a way for Gitleaks to report unused or stale ignores. Ideally, it would scan the configured ignore file and indicate which fingerprints no longer correspond to any current finding in the repository. A strict mode could optionally fail CI when an ignore entry is no longer matched, so teams can keep the ignore list clean over time.

Describe alternatives you've considered Using gitleaks:allow comments directly in code for intentional test secrets or fixtures, so the suppression moves with the code instead of living in a separate ignore file. This works for some cases, but it is not a good fit for all repositories or shared suppressions.

Another option is maintaining a custom CI script that compares current Gitleaks findings with the ignore file, but that duplicates logic and still leaves the behavior outside Gitleaks itself.

Additional context A similar feature in ESLint: https://eslint.org/docs/latest/use/configure/rules#report-unused-eslint-inline-config-comments

cc @zricethezav