fix(secret): skip regular strings contain secret patterns

[afdesk]

Description

Trivy shouldn't detect some strings containing letters before secret.
This PR excludes 0-9a-zA-Z for the next rules:

• AWS Access Key ID (DISPID_ICANVASRENDERINGCONTEXT2D_CANVAS)
• GitHub Personal Access Token (ghp_)
• GitHub OAuth Access Token (gho_)
• GitHub App Token (ghu_/ghs_)
• GitHub Refresh Token (ghr_)
• Hugging Face Access Token (hf_)
• Slack token (xoxb-/xoxa-/xoxp-/xoxr-/xoxs-)
• Stripe Publishable Key (pk_test_ / pk_live_)
• Stripe Secret Key(sk_test_ / sk_live_)
• Flutterwave public/secret key (FLWSECK_TEST-/FLWPUBK_TEST-)
• Flutterwave encrypted key (FLWSECK_TEST)

There is no need to skip secrets for the most cases, because such strings still contain sensitive data or have long alphanumeric sequence:

MyAWS_secret_KEY="12ASD34qwe56CXZ78tyH10Tna543VBokN85RHCas"

EasyPost API token was skipped, because this one should have quotes before and after a token.

Related issues

• Close fix(secret): add prefix to exclude 0-9a-zA-Z before secret #7176

Checklist

• I've read the guidelines for contributing to this repository.
• I've followed the conventions in the PR title.
• I've added tests that prove my fix is effective or that my feature works.
• I've updated the documentation with the relevant information (if needed).
• I've added usage information (if the PR introduces new options)
• I've included a "before" and "after" example to the description (if the PR is a user interface change).

[afdesk]

tests finally completed, so i think this PR is ready for review.

@knqyf263 @DmitriyLewen could you take a look when you have time? thanks

[afdesk]

@DmitriyLewen
wdyt about Twilio API Key?

is it possible to create a correct variable name only with A-F letters?

trivy/pkg/fanal/secret/builtin-rules.go

Lines 245 to 252 in 9269563

	{
	ID: "twilio-api-key",
	Category: CategoryTwilio,
	Title: "Twilio API Key",
	Severity: "MEDIUM",
	Regex: MustCompile(`SK[0-9a-fA-F]{32}`),
	Keywords: []string{"SK"},
	},

[DmitriyLewen]

I think we can add prefix for github-fine-grained-pat and gitlab-pat.

wdyt about Twilio API Key?
is it possible to create a correct variable name only with A-F letters?

I don't understand you. Unexpected prefix can use any characters.

[afdesk]

gitlab-pat

gitlab-pat is added now, Twilio API Key and github-fine-grained-pat are skipped.

[DmitriyLewen]

Twilio API Key and github-fine-grained-pat are skipped.

We talked offline with @afdesk and decided that the likelihood of accidentally obtaining these secrets is extremely low and there is no need to add prefix check for them.

[DmitriyLewen]

LGTM