feat(secrets): add HashiCorp Cloud Platform (HCP) secret detection and validation

[thevilledev]

NOTE: I'll keep this as a draft until #1299 is merged, since this implementation should use the same common JWT utilities.

Detection:

• HCP client credentials exposed as env-style pairs: HCP_CLIENT_ID (32 chars, alphanumeric) and HCP_CLIENT_SECRET (64 chars, [A-Za-z0-9._~-]). These tokens cannot be identified otherwise since there's no common prefix/suffix. Pairs the nearest ID/secret within a small window (256 bytes); emits singletons if only one present.
• HCP access tokens (JWT) identified via bounded base64url regex and validated by claims.

Validation:

• Client credentials validated via OAuth2 client credentials token exchange. If a token can be generated with the given ID and Secret it is considered valid. POSTs to token endpoint https://auth.hashicorp.com/oauth/token to validate; 200 => VALID, 400/401 => INVALID, other => FAILED.
• Access tokens validated by calling the HCP caller-identity endpoint. GETs https://api.cloud.hashicorp.com/iam/2019-12-10/caller-identity with a bearer token; 200 => VALID, 401 => INVALID, other => FAILED.

Documentation:

• API overview, including token API call: https://developer.hashicorp.com/hcp/docs/hcp/api
• IAM endpoint for getting caller identity: https://developer.hashicorp.com/hcp/api-docs/identity#IamService_GetCallerIdentity

Fixes #1253