fix: global commit allowlist silently bypassed due to misscoped continue

## Description

Global `[[allowlists]]` entries with `commits = [...]` are silently ignored during `gitleaks git` scans. The commit is logged as skipped but is fully scanned anyway, producing findings that should be suppressed.

## Root Cause

In `sources/git.go`, the `continue` statement inside the allowlist loop only advances to the **next allowlist entry** — it does not skip the outer diff-file processing:

```go
// BEFORE (buggy)
for _, a := range s.Config.Allowlists {
if ok, c := a.CommitAllowed(gitdiffFile.PatchHeader.SHA); ok {
logging.Trace().Str("allowed-commit", c).Msg("skipping commit: global allowlist")
continue // ← only continues inner for-loop, not the outer select/for
}
}
// commitInfo build and goroutine launch always happen regardless
```

After the inner `for` loop completes, execution falls through unconditionally to build `commitInfo` and launch the scanning goroutine for every commit — including ones that matched the allowlist.

## Steps to Reproduce

1. Create a repo with at least one commit containing a secret
2. Add a global `[[allowlists]]` block to your config with that commit's SHA:
```toml
[[allowlists]]
commits = [""]
```
3. Run `gitleaks git`

**Expected:** No findings reported (commit is allowlisted)
**Actual:** Finding is reported; trace log says "skipping commit: global allowlist" but the commit is still scanned

## Fix

Use a boolean flag to escape the allowlist loop and then `continue` the outer loop:

```go
// AFTER (fixed)
commitAllowed := false
for _, a := range s.Config.Allowlists {
if ok, c := a.CommitAllowed(gitdiffFile.PatchHeader.SHA); ok {
logging.Trace().Str("allowed-commit", c).Msg("skipping commit: global allowlist")
commitAllowed = true
break
}
}
if commitAllowed {
continue // ← correctly skips to next diff file
}
```

## Environment

- Affects all versions of gitleaks that include global `[[allowlists]]` commit support
- Rule-level `[[rules.allowlists]]` with commits is **not** affected (different code path in `detect.go`)

Start in sources/git.go at the global allowlist loop described in the issue, then trace how each diff file proceeds to commitInfo construction and scanning. Reproduce the case with a commit SHA in a global [[allowlists]] block and run gitleaks git; done means the allowlisted commit produces no findings and is not scanned.

Written by the indexing model from the issue text.