fix(analyzers): broaden and redact secret detection

[adity982]

Summary

Broadens data-leakage detection for common AI/provider credentials, modern GitHub and package-registry tokens, private-key headers, and JSON/YAML-style generic assignments. Source evidence now redacts every recognized credential on a matching line, including lines containing multiple secrets.

Closes #55

Type of change

• Bug fix
• New feature / analyzer
• Breaking change
• Documentation

Test plan

• uv run pytest
• uv run ruff check src tests
• Manual CLI test (not applicable)

Validation performed:

• uv run pytest tests/test_analyzers.py -q — 13 passed
• uv run ruff check src tests — passed
• Full suite after uv sync --all-extras — 593 passed, 5 environment-specific failures on Windows: three CP1252/Unicode cases, one POSIX .venv/bin/python expectation, and one installed-global-skills isolation expectation. None exercise data_leakage.py; the focused analyzer suite is green.

Checklist

• CHANGELOG.md updated (if user-facing)
• Tests added or updated
• No real secrets or credentials in code (tests construct synthetic values)
• Docs updated if CLI behavior or report output changed (not applicable; analyzer behavior is covered in the changelog)