test_sensitive_information_protection: false positive — 'test' in skill tags matches 'test.*url' across entire card string

## Problem

`test_sensitive_information_protection` scans the entire agent card JSON as a single string and applies regex patterns including:

```python
r"(?i)(internal|private|admin|debug|test).*(?:url|endpoint|host)"
```

This causes false positives: if an agent card has a skill with a tag like `'testing'` or `'test'`, and the card also contains a URL (which every agent card does), the regex matches `test...url` across completely separate fields.

## Repro

Agent card with:
```json
{
"skills": [{
"tags": ["streaming", "tck", "testing", "cancel"]
}],
"supportedInterfaces": [{
"url": "http://localhost:9997"
}]
}
```

The string `...testing...url..." matches `test.*url` → test FAILS with:
```
SECURITY VIOLATION: Public Agent Card exposes sensitive information. Found 1 potential issues.
- test
```

## Root Cause

The test does:
```python
card_str = str(agent_card_data).lower()
for pattern in sensitive_patterns:
matches = re.findall(pattern, card_str)
```

This serializes the entire dict to a single string and runs regex across field boundaries. Any skill with a tag matching `test|debug|admin` will trigger this.

## Fix

Patterns should be applied per-field, not to the full card string. Specifically, the pattern `test.*url` should only flag something if both "test" and "url" appear in the **same field value**.

Alternative: remove the `test` from the pattern — there's nothing wrong with having a skill tagged `test` or describing the agent as a `testing` agent.

## Spec Reference

A2A v0.3.0 §9.1 (cited in test) is about protecting credentials and secrets — it does not prohibit skill tags named "test" or "testing".

## Also

The test cites "A2A v0.3.0 Section 9.1" — this is a v0.3 reference in a mandatory v1.0 test. The spec section reference should be updated to v1.0.

The test is in `test_sensitive_information_protection`. Examine the test's pattern matching logic that serializes the agent card to a string. The fix involves modifying the regex application to be per-field, likely in the test file or a helper module. Check for references to A2A spec sections to update the citation. Run the test with the provided repro case to verify the false positive is resolved.

Vom Indexierungsmodell aus dem Issue-Text verfasst.