baseline: accepted secrets at a line are recorded in plain text #224

Problem

A baseline entry records the text of the line a finding is on. For a secret located at a line (Python literal, .env, YAML, INI, TOML key, JSON value), that text holds the secret, so the baseline file, which is meant to be committed, contains every accepted secret in plain text. A later check then reports the baseline file itself (baseline.json:8:15 hardcoded-secret).

Since #222, findings with a file location are recognised by a digest of their value instead, so they do not leak; findings at a line still do.

To settle

• Record, for findings of the secret rules, a digest of the line text (or of the value) instead of the text; a transition is needed for baselines recorded before;
• and/or exclude the baseline file from the configuration scan.