Simplify detect-secrets workflow with single-source-of-truth script

Move detect-secrets args into scripts/detect_secrets_baseline.sh so the
pre-commit hook and baseline regeneration (`scripts/detect_secrets_baseline.sh scan`)
always use identical arguments. Adds slim-detect-secrets to dev extras so the
system-install local hook can find detect-secrets-hook.

Author: jordanpadams

.pre-commit-config.yaml

@@ -47,31 +47,10 @@ repos:
         stages: [push]
         pass_filenames: false
 
--   repo: https://github.com/NASA-AMMOS/slim-detect-secrets
-    # using commit id for now, will change to tag when official version is released
-    rev: 91e097ad4559ae6ab785c883dc5ed989202c7fbe
+-   repo: local
     hooks:
-      - id: detect-secrets
-        args:
-          - '--disable-plugin'
-          - 'AbsolutePathDetectorExperimental'
-          - '--baseline'
-          - '.secrets.baseline'
-          - --exclude-files '\.secrets..*'
-          - --exclude-files '\.git.*'
-          - --exclude-files '\.pre-commit-config\.yaml'
-          - --exclude-files '\.mypy_cache'
-          - --exclude-files '\.pytest_cache'
-          - --exclude-files '\.tox'
-          - --exclude-files '\.venv'
-          - --exclude-files 'venv'
-          - --exclude-files 'dist'
-          - --exclude-files 'build'
-          - --exclude-files '.*\.egg-info'
-          - --exclude-files '.*/test/.*'
-          - --exclude-files '.*/test/data/.*'
-          - --exclude-files '.*/tests/data/.*'
-          - --exclude-files '.*/test.*/data/.*'
-          - --exclude-files '.*/.*test.*/data/.*'
-          - --exclude-files 'src/.*/test/data/.*'
-          - --exclude-files 'tests/data/.*'
+    -   id: detect-secrets
+        name: detect-secrets
+        entry: scripts/detect_secrets_baseline.sh
+        language: script
+        pass_filenames: true