fix(ci): use alpine:latest with git for secret-scan

alpine/git has git as ENTRYPOINT, breaking sh-based script execution.
Use alpine:latest and install git via apk instead.