[Bug] Credential detection keys on three variable names and never on the value, so vendor keys and PEM blocks are missed

Summary

The credential detection in packages/core/src/repowise/core/analysis/security_scan.py keys only on the variable name, and only on three names. A fixture set of six common leaked-credential shapes gets 2/6 at HEAD (06d33e7). repowise security scan --history reuses the same kinds through SECRET_KINDS, so full git history has the same blind spots.

Mechanism

The registry has two credential patterns (security_scan.py:81-82):

(re.compile(r"(?i:password)\s*=\s*['\"]"), "hardcoded_password", "high"),
(re.compile(r"(?i:api_?key|secret)\s*=\s*['\"]"), "hardcoded_secret", "high"),

Nothing looks at the value. So these four lines, each a textbook leak, produce no finding:

AWS_ACCESS_KEY_ID = "AKIAQZXNRTVYWMPKLBHG"
GITHUB_TOKEN = "ghp_9K2vQ7xR4mZ1pL8tY6wU3nB0cF5hD9aE2gJ4sK7i"
SLACK_BOT_TOKEN = "xoxb-4721609583-T5Rk9mPz2Qa"
-----BEGIN RSA PRIVATE KEY-----

token and access_key are not in the keyword list, a vendor key assigned to client_id or passed inline is invisible, and there is no PEM pattern at all. The two hits in the fixture set were stripe.api_key = "sk_live_..." and GOOGLE_MAPS_API_KEY = "AIza...", both matched on the name alone.

Proposal

1. Add token and access_key to the keyword pattern.
2. Add value-shape patterns for the common vendor prefixes: AWS (AKIA/ASIA plus 16 uppercase alphanumerics), GitHub (ghp_, gho_, ghu_, ghs_, ghr_, github_pat_), Slack (xox[baprs]-), Google (AIza plus 35 chars), Stripe (sk_live_, sk_test_, pk_live_).
3. Add a PEM private-key pattern that requires a base64 body on the lines after the header, so code that assembles PEM text from the header string does not fire.

Two constraints for whoever picks this up. _ANY_PATTERN (security_scan.py:138) is built by concatenating raw pattern sources, so new patterns must carry inline (?i:...) groups rather than rely on re.IGNORECASE. And the reference for vendor shapes should be gitleaks' rule set, which is MIT; other scanners' pattern lists are under licenses that do not allow copying.

Tests belong in tests/unit/analysis/test_security_scan.py, one fixture per shape above plus the header-only PEM negative.

Related: #1935 covers the wider registry. This is scoped to credentials only. #2047 added the JS/TS patterns and is the model for the change shape.