[INS-472] Add user detector to defaults.go, gate it behind feat flag and update verification logic

[MuneebUllahKhan222]

Description:

This PR adds the User detector to defaults.go and gates it behind the appropriate feature flag.

Additionally, the PR updates the detector verification logic to align with the latest API behavior and validation requirements.

The PR also tightens the detector regex by removing support for the +, -, _, ., and = characters.

Checklist:

• Tests passing (make test-community)?
• Lint passing (make lint this requires golangci-lint)?

---

Note

Low Risk
Adds a gated detector and tightens regex/verification URL; no changes to core auth or sensitive infrastructure.

Overview
This PR enables the User secret detector in the default scan engine: it registers user.Scanner in defaults.go, adds UserDetectorEnabled in pkg/feature, turns it on by default in main.go, and filters the detector out when the flag is off (same pattern as Pinecone/Cloudinary/GitLab OAuth).

The User detector behavior is updated to match current API expectations: verification calls https://detectors.user.com/api/public/users/ instead of the old secretscanner.user.com host, and the token regex now requires exactly 64 alphanumeric characters (no +, -, _, ., or =).

Tests were adjusted for the stricter pattern and integration comparisons now use go-cmp with ignored result fields.

^{Reviewed by Cursor Bugbot for commit 681df22. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit c085ec8. Configure here.}

[github-actions]

Corpora Test Results

Scans a corpus of real-world public code against only the detectors changed in this PR, then compares unique match counts between the PR build and the main baseline to catch regex regressions. Verification is disabled — each detector's regex is measured independently.

1 new · 0 clean  |  Scoped to: user

Status	Detector	Unique matches (main)	Unique matches (PR)	New	Removed
🆕	User	—	13	—	—

• 🔴 regression: >5 new, >20% increase over main, or any removed
• ⚠️ warning: 1–5 new and ≤20% increase over main
• ✅ clean
• 🆕 new detector (no baseline)