test: add secrets detection hook regressions (#3931)

* test: add secrets detection hook regressions

Signed-off-by: lucarlig <luca.carlig@ibm.com>

* test: exercise secrets detection through manager dispatch

Signed-off-by: lucarlig <luca.carlig@ibm.com>

* test: load secrets hook cases through plugin config

Signed-off-by: lucarlig <luca.carlig@ibm.com>

* test: clarify manager-backed blocked payload assertions

Signed-off-by: lucarlig <luca.carlig@ibm.com>

* fix: update secrets baseline line numbers and fix import ordering

- Regenerate .secrets.baseline to reflect shifted line numbers after
  test additions (466 → 636)
- Fix isort import section ordering in test_secrets_detection.py

Signed-off-by: Mihai Criveti <crivetimihai@gmail.com>

---------

Signed-off-by: lucarlig <luca.carlig@ibm.com>
Signed-off-by: Mihai Criveti <crivetimihai@gmail.com>
Co-authored-by: Mihai Criveti <crivetimihai@gmail.com>

Author: lucarlig

.secrets.baseline

@@ -3,7 +3,7 @@
     "files": "package-lock.json|Cargo.lock|^.secrets.baseline$|scripts/sign_image.sh|scripts/zap|sonar-project.properties|^/Users/brian/dev/github.ibm.com/contextforge-org/sps-pipeline-config/.secrets.baseline$|^./.secrets.baseline$",
     "lines": null
   },
-  "generated_at": "2026-04-03T00:05:33Z",
+  "generated_at": "2026-04-03T08:21:47Z",
   "plugins_used": [
     {
       "name": "AWSKeyDetector"
@@ -11258,7 +11258,7 @@
         "hashed_secret": "86de8c52637ec530fe39b0a8471da9b8764d5242",
         "is_secret": false,
         "is_verified": false,
-        "line_number": 466,
+        "line_number": 665,
         "type": "AWS Access Key",
         "verified_result": null
       }