Add an option to ignore secrets which are removed by the scanned commit

[Walz]

Context

Add an option to ignore secrets which are removed by the scanned commit.
The goal of this PR is to create a way to accept secrets which are being remediated. If a dev is removing a secret from their code, but not rewriting the git history, GGShield will prevent them (pre-commit, pre-push or pre-receive) from committing and pushing the secret remediation.

This optional option will allow users to accept secrets in commits when they are removed, either on a deleted line or in a deleted file.

What has been done

• Add --ignore-removed-secrets via the decorator add_secret_scan_common_options
• Add an equivalent field to SecretConfig named ignore_removed_secrets

Validation

Create a repository, add then remove a secret:

git init
echo "ggtt-v-7faxcu9ak6" > secret.txt
git add secret.txt
git commit -m "add secret"
echo "remove" > secret.txt
git add secret.txt
git commit -m "remove secret"

Then verify that scanning the repository raises two incidents and only one with --ignore-removed-secrets

$ ggshield secret scan repo . --json | jq .total_incidents
Scanning... ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 100% 2 / 2
2

$ ggshield secret scan repo . --json --ignore-removed-secrets | jq .total_incidents
Scanning... ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 100% 2 / 2
1

PR check list

• As much as possible, the changes include tests (unit and/or functional)
• If the changes affect the end user (new feature, behavior change, bug fix) then the PR has a changelog entry (see doc/dev/getting-started.md). If the changes do not affect the end user, then the skip-changelog label has been added to the PR.

[agateau-gg]

Minor remarks, looks good.

[agateau-gg]

This generator expression is a bit long. Can you move it to a helper function?

[agateau-gg]

Can you set this to False by default, to be consistent with the default value in SecretConfig?

[agateau-gg]

Suggested change

	help="Ignore secrets which are removed by the scanned commit.",
	help="Ignore secrets removed by the scanned commit.",

[agateau-gg]

Suggested change

	- Add option `--ignore-removed-secrets` to ignore secrets which are removed by the scanned commit.
	- Add option `--ignore-removed-secrets` to ignore secrets removed by the scanned commit.

[agateau-gg]

The leaky_repo() fixture uses tmp_path_factory because it's a module-scope fixture, but since this test creates its own repo, it can use tmp_path.

[agateau-gg]

nit:

Suggested change

	os.remove(secret_file)
	secret_file.unlink()

[agateau-gg]

Suggested change

	# GIVEN a repository with a past commits adding and removing a leak
	# GIVEN a repository with a commit adding a leak
	# AND another commit removing the leak