Update Mailgun detector

[rgmz]

Description:

This PR implements the following changes to the Mailgun detector:

1. Adds key- as a keyword, as it's a unique prefix of one token type

2. Deduplicates matches in a chunk's data

3. Updates the detector to use tri-state verification

4. Adds the domain response as extradata

   ✅ Found verified result 🐷🔑
   Detector Type: Mailgun
   Decoder Type: PLAIN
   Raw result: key-3ax6xnjp29jd6fds4gc37jsgvjxtedl0
   Domains: adfewasfdagafdasfdafdf.com (unverified,custom), samples.mailgun.org (ate:active,sandbox)
   Commit: 8b4342e2eb4f56deb646d3c56001c904712deb34
   Email: John Mailgun <[email protected]>
   ...
   

5. Fixes what appears to be a bug in the verification logic

   This line of code does not seem to do what it the comment claims.

   trufflehog/pkg/detectors/mailgun/mailgun.go

   Lines 59 to 64 in 14b1a6e

   	// If resMatch has "key" prefix, use it as the username for basic auth.
   	if strings.HasPrefix(resMatch, "key-") {
   	req.SetBasicAuth("api", resMatch)
   	} else {
   	req.Header.Add("Authorization", fmt.Sprintf("Basic %s", resMatch))
   	}

   Mailgun seems to require basic auth for all token tokens. The way this logic is written means that key- tokens will be properly verified, but other types like "Hex" won't be unless they happen to be base64-encoded and 72 characters (so they match the "Original MailGun Token" regex).

   e.g., this is a a base-64 encoded hex key that only gets detected because it happens to match the "Original" pattern.

       Authorization:
       - Basic YXBpOmQwMTViNWNkYjlhNTgzNjg1ZDhkM2ZiMWJlYzBmMjBkLTA3YmM3YjA1LWRhNDgxNmEx
   

   If it was instead found in plain-text like below, it would be skipped.

   mailgun_key = 'd915b5cdb9a583685d8f3fb1bec0f20f-07bc7b05-fa4816a1'
   

   I'm partially convinced that the "Original MailGun Token" is just the hex token base64-encoded.

Checklist:

• Tests passing (make test-community)?
• Lint passing (make lint this requires golangci-lint)?

[ahrav]

Thanks! Only took 6 months to get approved. 😢 Sorry about that.