Investigate replacing the secrets detection engine

[lucarlig]

Summary

Replace the current hand-maintained 11-regex secrets scanner with a maintained detection framework. The implementation may use Rust, Python, or Go through the available CPEX bindings.

Alternatives

• Kingfisher: Broadest coverage and embeddable Rust API, but Vectorscan may not support the full wheel matrix.
• Titus: Go library with 487 rules and a portable pure-Go fallback.
• Yelp detect-secrets: Low-effort Python integration supporting arbitrary strings.
• Betterleaks: Portable Go scanner with filtering designed to reduce natural-language false positives.
• Gitleaks: Mature stdin scanner, but now feature-complete and receiving security fixes only.
• Rusty Hog: Embeddable Rust scanner with a smaller regex catalog.

Platform targets

Linux s390x and Linux ppc64le (PowerPC) must be discussed explicitly. For each candidate, document whether it:

• Builds and runs natively on both targets.
• Requires a portable or slower fallback engine.
• Changes wheel packaging, system dependencies, or CI requirements.
• Would require a separate backend on either target.

Do not remove either target from the release matrix without an explicit project decision.

Requirements

• The selected framework must use an MIT or Apache-2.0-compatible license.
• Evaluate detection accuracy, false positives, performance, packaging, and platform support.
• Select one framework as the primary engine.
• Preserve blocking, redaction, hooks, and sanitized metadata.
• Preserve configuration allowing individual secret types to be enabled or disabled.
• Map existing detector names to the selected engine’s rule IDs or groups.
• Never expose matched secrets in logs, metadata, or errors.
• Disable credential validation and outbound requests by default.

[jonpspri]

Cross-reference: the gateway-side consumer issue is now IBM/mcp-context-forge#5938 — "Port secret detection to detect-secrets library". Note the roadmap names Yelp detect-secrets as the target engine; this evaluation should treat it as the leading candidate.