Add detect-private-key pre-commit hook

[zhanwu]

It doesn't work with api_tokens.json, but still worthing adding it for other cases