secrets: a secret built from several string literals is judged one literal at a time #228

Problem

The secret detectors judge each string literal on its own (plugins/secrets.py, literals). A secret written as several constant literals joined together is never seen whole:

KEY = ("-----BEGIN RSA PRIVATE KEY-----\n" +
       "ZZZZowIBAAKCAQ\n" +
       "-----END RSA PRIVATE KEY-----")

PASSWORD = "Zx81kQpL" + "w0RtY7vB" + "n3MsD9cF"
TOKEN = "ghp_" + "a1B2a1B2a1B2a1B2a1B2a1B2a1B2a1B2a1B2"

Checked on main (d5a7cd1):

• KEY is reported (hardcoded-secret) from its header literal alone, with a span covering line 1 only. Changing the body (ZZZZ… → AAAA…) is absorbed by a baseline: no findings, 1 baselined, exit 0. A new secret must never be absorbed by a baseline (baseline: a secret in a multi-line Python string is recognised by its first line only #223 fixed this for a single multi-line literal, not for several literals).
• PASSWORD and TOKEN are not reported at all: no piece is a credential value or matches a provider pattern on its own.

Implicit concatenation ("ab" "cd") is already one constant and is judged whole. "\n".join([...]) over constant strings and f-strings whose parts are all constant have the same problem.

Found in review of #226.

Expected

Fold a string expression whose parts are all constant (+ of string constants, str.join of a constant separator over a list or tuple of constants) into one value, judge that value, and report it at the span of the whole expression, so the baseline digests every line of it. Pieces of a folded expression are not judged again on their own (one finding per secret).

Regression tests: the three assignments above are reported, and a changed body of KEY is new with --baseline.