Finite-key security analysis for quantum key distribution with leaky sources