[feature] pre-submit to prevent exposing keys

[ianlewis]

Add a simple pre-submit that prevents inclusion of private keys or GitHub PAT tokens.

From OpenSSF best practices:

1. The public repositories MUST NOT leak a valid private credential (e.g., a working password or private key) that is intended to limit public access [no_leaked_credentials]

[ianlewis]

GitHub provides secret scanning for all repos which will alert project maintainers.
https://docs.github.com/en/code-security/secret-scanning/about-secret-scanning

This might be just as good as pre-submits since the secret would be leaked in the PR code anyway. Though I suppose pre-submits would allow the code to be deleted, whereas if it was merged into the repo it could not.

[ianlewis]

I think this criteria is met by the GitHub secrets scanning.