fix(webui): allowlist the shortcut storage key name for the leak scanner

The settings shortcut storage key reads like a credential to gitleaks'
generic-api-key rule, so the release audit rejected this branch. It is a
localStorage key name, not a secret, so allowlist it next to the other
documented non-credentials.

Author: stevenjj33

.gitleaks.toml

@@ -19,6 +19,13 @@ paths = ['''(^|/)packages/(browser-extension/test/protocol\.test\.ts|webui/test/
 regexTarget = "secret"
 regexes = ['''^00112233445566778899aabbccddeeff$''']
 
+[[rules.allowlists]]
+description = "WebUI shortcut storage key name, not a credential"
+condition = "AND"
+paths = ['''(^|/)packages/webui/src/client/projection/common/shortcuts\.ts$''']
+regexTarget = "match"
+regexes = ['''^SHORTCUT_STORAGE_KEY = "webui-shortcuts\.v1"$''']
+
 [[rules.allowlists]]
 description = "Documented keyboard shortcut"
 condition = "AND"