Add detect-secrets pre-commit hook and CI secret scanning workflow

[inputdrive]

Summary

This PR adds a lightweight secret-scanning workflow to the repository to help catch accidental credential exposure earlier.

What changed

• Added a local pre-commit hook using detect-secrets via .pre-commit-config.yaml
• Added a CI job in ci.yml that runs detect-secrets on pull requests and fails when new findings are introduced relative to .secrets.baseline
• Added a security policy and canary-token guidance in SECURITY.md

Why

This improves the repository’s defenses against accidental secret leaks by enforcing checks both locally and in CI, and it documents how contributors should report security issues and use canary tokens safely.

Notes

• The workflow excludes .venv contents to avoid noise from third-party dependencies.
• The baseline file is used to avoid failing on historical or expected results while still catching newly introduced findings.

Validation

• Ran detect-secrets baseline generation locally
• Added CI enforcement for new findings