Replace trufflehog with detect-secrets

[ElenaKhaustova]

Description

Solves #4062

Development notes

In this PR we replace trufflehog with detect-secrets - https://github.com/Yelp/detect-secrets for secrets detecting locally and at the CI:

• Added detect-secrets as a test dependency;
• Generated and added .secrets.baseline - a baseline of potential secrets currently found in git repository against which further checks are done. So they are not considered as newly added secrets.
• Added pre-commit hook locally to run detect-secrets on committed files only;
• Added Github Action to run detect-secrets to scan all tracked files;
• Removed trufflehog dependency and secret-scan make command.

CI test: 8d7da69

To test locally:

1. make install-test-requirements
2. make install-pre-commit
3. Add some key to the codebase and try to commit changes

Developer Certificate of Origin

We need all contributions to comply with the Developer Certificate of Origin (DCO). All commits must be signed off by including a Signed-off-by line in the commit message. See our wiki for guidance.

If your PR is blocked due to unsigned commits, then you must follow the instructions under "Rebase the branch" on the GitHub Checks page for your PR. This will retroactively add the sign-off to all unsigned commits and allow the DCO check to pass.

Checklist

• Read the contributing guidelines
• Signed off each commit with a Developer Certificate of Origin (DCO)
• Opened this PR as a 'Draft Pull Request' if it is work-in-progress
• Updated the documentation to reflect the code changes
• Added a description of this change in the RELEASE.md file
• Added tests to cover my changes
• Checked if this change will affect Kedro-Viz, and if so, communicated that with the Viz team

[ravi-kumar-pilla]

Tested locally and it works well... awesome work @ElenaKhaustova . Thank you

[DimedS]

Thanks for the PR, @ElenaKhaustova!
Could you please provide some context on:

• Why we changed the architecture from local to repo (and removed secret-scan from the Makefile)?
• In this case, do we still need the detect-secrets~=1.5.0 dependency in pyproject.toml?

[ElenaKhaustova]

Previously we had secret-scan command in the Makefile and pre-commit used this command as entry point (local). Now we use proper pre-commit hook (https://github.com/Yelp/detect-secrets) to run locally and an executable is still needed.

[ankatiyar]

LGTM! Tried locally

[DimedS]

thanks for PR and clarification, @ElenaKhaustova !

[ankatiyar]

Worth doing this in the other repos too - kedro-plugins

[ElenaKhaustova]

Worth doing this in the other repos too - kedro-plugins

Yep, makes sense - I will keep original issue opened until we make it for other repos 👍