fix: only select commits ahead of main branch for gitleaks

This is a follow-on from !194 (merged), which was still pulling commits from behind main.

Removes the --all flag, which was being passed to git log:

The -all flag is described as:

       --all
           Pretend as if all the refs in refs/, along with HEAD, are listed on the command line as <commit>.

We definitely do not want this.