False positive: Env var is from config, not vault, and contains the name of another env var

**Description of the false positive**

This flagged for outputting the value of an environment variable to logs. Generally, that could be a problem. In this case, the env var clearly contained the name of another env var to look in for the secret. Is there a way to not flag in this situation? For example, could we determine that this environment variable came from a k8s env var (where secrets are not allowed) as opposed to from vault?

**Code samples or links to source code**

https://github.com/github/blackbird/blob/d5fc30382331e6f5cd03c7f8695afadeeb631075/crates/config/src/embeddings.rs#L76-L79

**URL to the alert on GitHub code scanning (optional)**

https://github.com/github/blackbird/security/code-scanning/5068

Comienza con el código enlazado en crates/config/src/embeddings.rs en las líneas 76-79 e inspecciona la alerta de code-scanning 5068 para identificar la consulta de CodeQL y la ruta de flujo de datos que producen el hallazgo. Se considera terminado cuando este valor de configuración ya no se notifica como salida secreta, mientras se sigue detectando la exposición de secretos genuinos de variables de entorno.

Escrito por el modelo de indexación a partir del texto del issue.