infra: detect-secrets baseline and pre-commit hook

[incendiary]

Generate .secrets.baseline and wire detect-secrets into .pre-commit-config.yaml and CI.