--import baseline could be smarter

[domanchi]

Issues

• When using --import <baseline_filename>, a baseline is created without knowledge of the existing baseline file. This means that the current baseline file will be scanned for secrets (which it will clearly find, due to the secret hashes stored in there).

• When we upgrade baselines, we currently need to perform a two-liner (without sponge):

$ detect-secrets scan --import .secrets.baseline > .secrets.baseline.new
$ mv .secrets.baseline.new .secrets.baseline

If we already know the filename we're importing from (as compared to reading from stdin), we should also write to it.

Suggested Fix

$ detect-secrets scan --upgrade .secrets.baseline

This will write results to the provided file, and ignore the false positives in the current baseline file.