feat: cache auth check api calls for secret scans

[6d7a]

Context

check_client_api_key hits /v1/metadata and /v1/api_tokens/self on every invocation. When a caller runs bursty scans — notably the GitGuardian VSCode extension, which rescans on every save — this is two API round-trips per scan even though the key state rarely changes between them.

What has been done

This PR caches a successful auth check on disk for a short TTL (300s) keyed on (instance_url, api_key_hash). While the entry is fresh, check_client_api_key returns without contacting the API, provided the cached scopes cover the required ones. A cache entry seeded without scopes (e.g. from auth login) still skips /v1/metadata but falls through to /v1/api_tokens/self when the caller needs scopes.

Trade-off: a server-side key revocation may not be observed for up to the TTL. This is self-healing — the next API call returns 401, which runs through handle_api_error and invalidates the cache.

Validation

• create a test file to scan echo "my secret" > /tmp/scan-me.txt
• run uv run ggshield --debug secret scan path /tmp/scan-me.txt twice in succession and confirm the second invocation does not log the metadata/api_tokens round-trips

PR check list

• As much as possible, the changes include tests (unit and/or functional)
• If the changes affect the end user (new feature, behavior change, bug fix) then the PR has a changelog entry (see doc/dev/getting-started.md). If the changes do not affect the end user, then the skip-changelog label has been added to the PR.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 93.66%. Comparing base (1c0e523) to head (cf4e4a1).

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1216      +/-   ##
==========================================
+ Coverage   93.57%   93.66%   +0.08%     
==========================================
  Files         181      182       +1     
  Lines        9442     9560     +118     
==========================================
+ Hits         8835     8954     +119     
+ Misses        607      606       -1     

Flag	Coverage Δ
unittests	93.66% <100.00%> (+0.08%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.