Security Scan: stop flagging pinned hashes and test fixtures on release PRs #2225

On the 2.2.0 release PR (#2214), Security Scan (detect-secrets, run 37994261254) failed on findings that are not secrets:

• the sha256 pins in surfsense_local/backend/modules/runtime_packs/office/pin.py and a keyword in office/detect.py;
• surfsense_local/electron/src/main/sidecars/python.test.ts and supervisor.test.ts;
• the base64 fixtures in surfsense_local/frontend/src/features/docx-snapshot/fixtures/;
• surfsense_backend/app/utils/proxy/providers/nodemaven.py:16.

None match the hook's excludes (.*/tests/.*, test_.*\.py), and the scan covers every file a release changes since main.

Done when: these are audited into .secrets.baseline or the excludes cover *.test.ts and fixtures/, so a release PR's scan shows only real findings.