feat: verify .netlify doesn't contain sensitive information

[erezrokah]

Is your feature request related to a problem? Please describe.

Per this comment .netlify can contain sensitive information.

At the moment we have under that folder:

1. state.json with the linked site id
2. Auto installed plugins under .netlify/plugins (after running netlify build)
3. Bundled functions under .netlify/functions (after running netlify build)

None of these is sensitive, but they still should not be committed to the repo.

We should verify the statement in #506 (comment) is still true, and find a better way to prevent users from committing sensitive information as users can also manually update .gitignore.

Describe the solution you'd like

If we do plan to save sensitive I don't think we should have under a folder that can be committed by mistake.
The solution might be verifying we don't save sensitive information under .netlify at the moment and prevent future code changes from doing so.

Describe alternatives you've considered

N/A

Additional context

#2029 (comment)

Can you submit a pull request?

Yes