py/HardcodedCredentials misses common credential patterns and flags usernames.

Some patterns are missing, for example:
```python
api_key = "sk-1234567890" # Missed: API key
db_url = "postgres://user:pass@host/db" # Missed: URL credentials
```

Second, I am not sure if the username is seen as a credential in a usual project, but this rule will flag the username.
This is beyond the definition in CWE-798 (
The product contains hard-coded credentials, such as a password or cryptographic key.)

```python
USERNAME = "admin" # Flagged
```

I also found that the rule will lose the taint in the following case:
```python
USERNAME = "road_runner"
PASSWORD = "insecure_pwd"
options = {"password": PASSWORD}

conn = client.connect(username=USERNAME, password=PASSWORD) # Flagged
log.debug("Options: %s", options) # Missing
conn = client.connect(options=options) # Still Missing
```

Start with the py/HardcodedCredentials rule and reproduce the API-key, URL-credential, username, and options examples from the issue. Read how the rule models credential patterns and propagates taint through the options dictionary. Done means the missing credential cases are detected without treating ordinary usernames as credentials, with coverage for the reported examples.

索引モデルが issue の本文から書いたものです。