security: remove hardcoded secrets and SSL private key

[isaksmith]

• Remove real GitHub OAuth credentials from config/application.yml
• Remove committed SSL private key (config/localhost.key)
• Add config/application.yml to .gitignore to prevent future leaks
• Remove exception that allowed .key files to be tracked

[welcome]

Thanks for opening this pull request! This space is protected by our Code of Conduct - and we're here to help.
Dangerbot will test out your code and reply in a bit with some pointers and requests.
Also please refer here for installation help 💿
There may be some errors, but don't worry! We'll work through them with you! 👍🎉😄


One thing that can help to get started is to make sure you've included a link back to the original issue you're solving, in the format fixes #0000 (for example). And to make sure the PR title describes what you're trying to do! (often it can be the same as the issue title) Thanks! 🙌


Then, you can say hello in our chatroom & share a link to this PR to get a review! 👋 ✅