always render source section in secrets.toml, even if there are no secrets, add gitignore to output

always render source section in secrets.toml, even if there are no secrets, add gitignore to output #277