feat(detectors): add Tencent Cloud credential detector

[0xDevNinja]

Description:

Adds a new verifiable detector for Tencent Cloud credentials (Closes #4036).

Tencent Cloud uses a two-part credential:

• SecretId — AKID prefix followed by 32 alphanumeric characters
• SecretKey — 32 alphanumeric characters, paired with a SecretId

The detector anchors on the AKID-prefixed SecretId and pairs it with nearby SecretKey candidates (filtered by Shannon entropy to cut down on false positives from generic 32-char strings).

Verification signs a DescribeRegions request to the CVM API (cvm.tencentcloudapi.com) with Tencent's TC3-HMAC-SHA256 scheme. Tencent's 3.0 APIs return HTTP 200 even for authentication failures, embedding an Error block in the JSON body, so verification inspects the body: an AuthFailure.* code is treated as determinately invalid, the absence of an error means the credentials are valid, and any other error code surfaces as an indeterminate result.

No new third-party SDK is pulled in — the signature is computed with the standard library.

Checklist:

• Tests passing (make test-community)?
• Lint passing (make lint this requires golangci-lint)?

---

Note

Medium Risk
Verification performs outbound signed API calls with discovered credentials (standard for verifiable detectors), and pairing generic 32-char strings may still produce noise despite entropy filtering.

Overview
Adds Tencent Cloud SecretId/SecretKey detection and optional live verification, and registers it as DetectorType_TencentCloud (1056) in the default engine.

Detection keys off AKID-prefixed SecretIds and pairs them with 32-character SecretKey candidates in the same chunk, dropping low-entropy keys to limit false positives. When verification is on, credentials are checked by signing a DescribeRegions call to the CVM API with TC3-HMAC-SHA256 (stdlib only). Tencent returns HTTP 200 for auth failures, so the scanner treats missing Response.Error as valid, AuthFailure.* as invalid, and other errors as indeterminate.

Unit tests cover patterns, mocked verification paths, and timeouts; integration tests use GCP-stored secrets behind the detectors build tag.

^{Reviewed by Cursor Bugbot for commit 091fed4. Bugbot is set up for automated code reviews on this repo. Configure here.}