False positive: Env var is from config, not vault, and contains the name of another env var

**Description of the false positive**

This flagged for outputting the value of an environment variable to logs. Generally, that could be a problem. In this case, the env var clearly contained the name of another env var to look in for the secret. Is there a way to not flag in this situation? For example, could we determine that this environment variable came from a k8s env var (where secrets are not allowed) as opposed to from vault?

**Code samples or links to source code**

https://github.com/github/blackbird/blob/d5fc30382331e6f5cd03c7f8695afadeeb631075/crates/config/src/embeddings.rs#L76-L79

**URL to the alert on GitHub code scanning (optional)**

https://github.com/github/blackbird/security/code-scanning/5068

Comece pelo código vinculado em crates/config/src/embeddings.rs nas linhas 76-79 e inspecione o alerta de code-scanning 5068 para identificar a consulta do CodeQL e o caminho do fluxo de dados que produzem a descoberta. Considera-se concluído quando esse valor de configuração não for mais reportado como saída secreta, enquanto a exposição de segredos genuínos de variáveis de ambiente continuar sendo detectada.

Escrita pelo modelo de indexação a partir do texto da issue.