baseline: a secret in a multi-line Python string is recognised by its first line only #223

Problem

A baseline entry records the text of a finding's first line. A secret written in a Python triple-quoted string starts on a line that does not hold it:

KEY = """
-----BEGIN RSA PRIVATE KEY-----
MIIEowIBAAKCAQEA...
-----END RSA PRIVATE KEY-----
"""

The finding is located at line 1, whose text is KEY = """. Replacing the key with another one keeps that text, so the new key is baselined ("no findings, 1 baselined"). A new secret must never be absorbed by the baseline.

Found in review of #222; the same case for a multi-line element of a TOML array was fixed there (such an element gets a file location, whose digest of the value the baseline compares). Python literals are located by the parser and keep their span.

To settle

• Fingerprint a finding whose span covers several lines by the text of all of them, or by a digest of the literal's value; either changes the fingerprint of existing multi-line findings, so baselines recorded before would need a transition (as schema 1 → 2 in fix: locate structured-file findings at their own line, or by pointer #222);
• or restrict the change to secret rules, whose findings carry the literal.

Regression test: record a baseline with a multi-line secret, change its body, check that it is reported as new.