ci(sec): add pip audit and detect secrets in precommit and ci

[whatsacomputertho]

In this PR, I set up pip-audit and detect-secrets to run as pre-commit hooks and to run in CI. I create a new sec recipe to run both tools, and sec-dependencies to install them and install their pre-commit hooks.

For reference, see:

• Audit dependencies in pre-commit config and in CI #7
• Detect secrets in pre-commit config and in CI #8