security: fix secret leakage hardcoded tokens and credentials (Punto 3)

- .gitignore: Add protection for .env, *.pem, *.key, private_key.pem, privkey.pem, ec.key, chiave_privata.key, and shell scripts bal-*.sh
- make_release.sh: Remove hardcoded token 5cfa8c33e337ebaadb355c0ffa2d053d521ee43b
  Add loading from .env file with GITEA_API_TOKEN variable
  Add error handling if token is not set (prevents script from running without proper authentication)
- .env.example: Add template file for Gitea API token setup (not committed to git, .gitignored)
- generate_keys.sh: Add chmod 600 to protect private_key.pem permissions
- contrib/download_and_install_bal.sh: Remove hardcoded xpub and fixed_fee.
  Make all settings required as arguments or environment variables (xpub, fixed_fee, willexecutor_url, email, info)
  Add proper error handling and usage instructions if required arguments are not provided
- tests/secret_leakage_tests.rs: Add regression tests that:
  * Verify .gitignore protects .env, .pem, .key files
  * Verify no private key files are tracked in git (only public_key.pem is allowed)
  * Scan shell scripts for potential hardcoded tokens
- All tests pass: cargo test (8 tests: 3 SQL injection + 2 panic regression + 3 secret leakage)
- Build verified: cargo check (0 errors)

.gitignore

@@ -1,4 +1,41 @@
 .gitsecret/keys/random_seed
 !*.secret
-bal-pusher.env
+
+# Environment files - NEVER commit tokens or secrets
+*.env
+.env
+.env.local
+.env.production
+.env.secret
+
+# Shell scripts that load env vars (contain secrets, local only)
 bal-pusher.sh
+bal-server.sh
+
+# Private keys - NEVER commit to git
+# Only public_key.pem should be tracked (if needed)
+*.pem
+!public_key.pem
+data/*.pem
+!data/public_key.pem
+*.key
+!*.secret
+private_key.pem
+privkey.pem
+ec.key
+chiave_privata.key
+
+# Other sensitive files
+bal.db
+.bal.db
+download_bal_db.sh
+
+# IDE files
+*.swp
+*.swo
+# Rust build artifacts
+/target
+Cargo.lock
+!lib/
+!contrib/
+!src/