chore(ci): filter false positives in secret scanner and refine rust token regex

Author: hyperpolymath

.github/workflows/secret-scanner.yml

@@ -49,6 +49,16 @@ jobs:
 
           findings =
             tracked_files
+            |> Enum.reject(fn rel_path ->
+              # Known safe test files/docs containing mock credentials
+              rel_path in [
+                "emergency-room/src/zig/capture_test.zig",
+                "czech-file-knife/docs/DISTRIBUTED_FILESYSTEMS.md",
+                "hybrid-automation-router/test/attestation/a2ml_test.exs",
+                "hybrid-automation-router/test/data_plane/transformers/kubernetes_test.exs",
+                "hybrid-automation-router/docs/HAR_SECURITY.md"
+              ]
+            end)
             |> Enum.flat_map(fn rel_path ->
               abs_path = Path.join(repo, rel_path)
 
@@ -277,7 +287,7 @@ jobs:
           PATTERNS=(
             'const.*SECRET.*=.*"'
             'const.*KEY.*=.*"[a-zA-Z0-9]{16,}"'
-            'const.*TOKEN.*=.*"'
+            'const.*TOKEN.*=.*"[a-zA-Z0-9\-_]{16,}"'
             'let.*api_key.*=.*"'
             'HMAC.*"[a-fA-F0-9]{32,}"'
             'password.*=.*"[^"]+"'