feat: detect GitLab tokens and Azure client secrets

[jesse-quinn]

Summary

Adds two new built-in detection rules and closes a test/docs gap on GitHub fine-grained PATs:

• gitlab-token — GitLab personal access, deploy, runner, pipeline trigger, feed, and service account tokens (glpat-/gldt-/glrt-/glptt-/glft-/glsoat- prefixes), including the newer routable token format with dot-separated segments.
• azure-client-secret — Microsoft Entra ID (Azure AD) application client secrets, keyed on the distinctive <3 chars><digit>Q~ shape with a 31–34 char tail. Uses lookarounds instead of \b because the secret charset includes ~, ., and -.
• GitHub fine-grained PATs (github_pat_) were already matched by the existing github-token rule but had no test coverage or README mention — both added.

Details

• Both new rules are severity: critical, category: secret, token-replace redaction, matching the conventions of neighboring rules.
• Patterns are linear (no nested quantifiers) per the ReDoS guidance in CONTRIBUTING.md.
• Example strings are deliberately low-entropy so GitHub secret scanning / push protection doesn't flag them as live credentials (a realistic-looking GitLab sample was blocked by push protection on the first push attempt).
• dist/ rebuilt and committed per the CONTRIBUTING.md requirement.

Testing

• npm test — 178 tests pass, including new positive/negative cases for all three token families.
• End-to-end via the hook:

  echo "... glpat-... AZURE_CLIENT_SECRET=..." | node scripts/prompt-guard.js
  → decision: block — GitLab Token (gitlab-token), Azure Client Secret (azure-client-secret)