Guard against committed credentials: ignore secret files, secret scan in CI

.gitignore

@@ -20,3 +20,13 @@ target/
 results/
 # editor lock files
 .~lock.*#
+# credentials and secrets (never commit)
+.aws/
+.env
+.env.*
+*.pem
+*.key
+*.p12
+credentials
+.git-credentials
+.netrc