Production hardening for Rust secrets detection plugin

[gandhipratik203]

Production hardening for Rust secrets detection plugin

Follow-up from the Rust CPEX secrets detection spike in PR #148.

The spike PR focuses on validating the Rust CPEX integration path. Before this plugin is considered production-ready, we should address the following hardening items:

1. Improve private key detection/redaction

   • Current private_key_block detection only matches the PEM BEGIN marker.
   • Redaction should cover the full bounded PEM block, including header, body, and footer.
   • Add coverage for multiline PEM redaction and blocking behavior.

2. Validate blocking configuration against CPEX mode

   • block_on_detection=true should not be accepted with non-enforcing CPEX modes.
   • TRANSFORM, AUDIT, and FIRE_AND_FORGET do not enforce continue_processing=false.
   • The plugin should reject unsafe mode/config combinations or fail closed.
   • Avoid attaching the original unredacted payload as a deny fallback.

Acceptance criteria:

• Full PEM private key blocks are detected and safely redacted/blocked.
• block_on_detection=true is only allowed with modes that can enforce blocking.
• Tests cover multiline PEM handling and non-enforcing mode configuration.