test_sensitive_information_protection: false positive — 'test' in skill tags matches 'test.*url' across entire card string

## Problem

`test_sensitive_information_protection` scans the entire agent card JSON as a single string and applies regex patterns including:

```python
r"(?i)(internal|private|admin|debug|test).*(?:url|endpoint|host)"
```

This causes false positives: if an agent card has a skill with a tag like `'testing'` or `'test'`, and the card also contains a URL (which every agent card does), the regex matches `test...url` across completely separate fields.

## Repro

Agent card with:
```json
{
"skills": [{
"tags": ["streaming", "tck", "testing", "cancel"]
}],
"supportedInterfaces": [{
"url": "http://localhost:9997"
}]
}
```

The string `...testing...url..." matches `test.*url` → test FAILS with:
```
SECURITY VIOLATION: Public Agent Card exposes sensitive information. Found 1 potential issues.
- test
```

## Root Cause

The test does:
```python
card_str = str(agent_card_data).lower()
for pattern in sensitive_patterns:
matches = re.findall(pattern, card_str)
```

This serializes the entire dict to a single string and runs regex across field boundaries. Any skill with a tag matching `test|debug|admin` will trigger this.

## Fix

Patterns should be applied per-field, not to the full card string. Specifically, the pattern `test.*url` should only flag something if both "test" and "url" appear in the **same field value**.

Alternative: remove the `test` from the pattern — there's nothing wrong with having a skill tagged `test` or describing the agent as a `testing` agent.

## Spec Reference

A2A v0.3.0 §9.1 (cited in test) is about protecting credentials and secrets — it does not prohibit skill tags named "test" or "testing".

## Also

The test cites "A2A v0.3.0 Section 9.1" — this is a v0.3 reference in a mandatory v1.0 test. The spec section reference should be updated to v1.0.