fix(ci): restore broad secret scanning and include workflow files in secret-scan

[levineam]

Motivation

• Repair a regression that narrowed CI secret detection to a small allowlist and excluded .github/workflows/ci.yml, which allowed common names like CLIENT_SECRET, DISCORD_TOKEN, BOT_TOKEN, and GITHUB_TOKEN to evade CI scanning.
• Ensure both repository-history and changed-content secret scans cover all tracked paths and do not blind-spot workflow files.

Description

• Broadened the secret pattern in .github/workflows/ci.yml to reintroduce generic secret, token, and bearer name detection (including prefixed/suffixed variants) while retaining the high-confidence token prefixes already present.
• Removed the sensitive_exts allowlist and the explicit exclusion of .github/workflows/ci.yml so git grep searches the full tree by default and changed-content scans cover workflow files as well.
• Restricted diff-based changed-content scanning to added lines only by piping git diff through grep -E '^\+' and excluding diff metadata lines with grep -Ev '^\+\+\+' to avoid matching deleted/context lines; results are still filtered by scripts/filter-secret-scan-candidates.sh.
• Updated scripts/filter-secret-scan-candidates.sh to avoid suppressing the scanner's own pattern/definition lines while preserving the safe-GitHub-secrets reference filter by adjusting the safe-reference and scan-definition regexes.

Testing

• Ran git diff --check and bash -n scripts/filter-secret-scan-candidates.sh with no syntax errors reported.
• Verified detection of representative literals by running a grep/pipeline with CLIENT_SECRET, DISCORD_TOKEN, BOT_TOKEN, and GITHUB_TOKEN through the new pattern and scripts/filter-secret-scan-candidates.sh, which produced the four expected literal candidates while filtering the safe GitHub secrets reference.
• Executed node --test tests/release-please-config-test.js and observed 4/4 tests passing.
• Ran the full npm test suite in this environment and saw 92/93 control-plane tests pass with a single existing environment-sensitive failure (host-service module owned by an untrusted user is rejected regardless of mode) that is unrelated to the scanner changes.

---

Codex Task