Add detect-secrets scanning

[reevejd]

Sets up IBM detect-secrets with an audited baseline and a pre-commit hook.

https://jsw.ibm.com/browse/SKILLS-131558

Findings

1. charts/pontoon/README.md:62: [Basic Auth Credentials] Local-only connection string with throwaway words (username/password)
2. charts/pontoon/values-demo.yaml:20: [Secret Keyword] Obvious placeholder "ramdompassword" with "# change me" comment
3. charts/pontoon/values-demo.yaml:25: [Secret Keyword] Obvious placeholder "randompassword" with "# change me" comment
4. charts/pontoon/values-unsafe.yaml:21: [Secret Keyword] Obvious placeholder "ramdompassword" (typo)

Repo state

• Path taken: P (pre-commit)
• Package manager: None (no package.json)
• Husky version: N/A
• core.hooksPath (local): Not set
• Baseline: 4 findings, 4 audited, 0 real
• Hook test: secret blocked (exit 1), clean file allowed (exit 0)