test: build fake GitHub-PAT fixtures at runtime (clear GitGuardian alert)

pattern_matcher_test.go fed literal `ghp_...`-shaped strings to ScanContentForSecrets
to verify the GitHub-token regex. They are synthetic test inputs, not real
credentials, but the literal form tripped GitGuardian's GitHub-PAT detector on the
PR. Build the token fixtures at runtime (`"ghp_" + strings.Repeat(...)`) so no
token-shaped literal appears in source; the test still exercises the same regex.

No secret to rotate — these were never real tokens.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Author: h0tak88r

internal/utils/pattern_matcher_test.go

@@ -13,19 +13,24 @@ func TestScanContentForSecretsFindsMatch(t *testing.T) {
 		"AWS Access Key ID": {regexp.MustCompile(`AKIA[0-9A-Z]{16}`)},
 	}
 
+	// GitHub-PAT-shaped fixtures built at runtime so no token literal appears in
+	// source (these are fake test inputs, but a literal trips secret scanners).
+	ghToken := "ghp_" + strings.Repeat("a1B2", 9)  // 36 chars after the prefix
+	ghToken2 := "ghp_" + strings.Repeat("z9Y8", 9) // distinct, also 36 chars
+
 	tests := []struct {
-		name            string
-		content         string
-		source          string
-		wantMatchCount  int
-		wantContains    string
+		name           string
+		content        string
+		source         string
+		wantMatchCount int
+		wantContains   string
 	}{
 		{
 			name:           "github token found",
-			content:        "const token = \"ghp_1234567890abcdef1234567890abcdef1234\"",
+			content:        "const token = \"" + ghToken + "\"",
 			source:         "config.js",
 			wantMatchCount: 1,
-			wantContains:   "ghp_1234567890abcdef1234567890abcdef1234",
+			wantContains:   ghToken,
 		},
 		{
 			name:           "api key with quotes",
@@ -55,7 +60,7 @@ func TestScanContentForSecretsFindsMatch(t *testing.T) {
 		},
 		{
 			name:           "source prefix in output",
-			content:        "ghp_abcdefghijklmnopqrstuvwxyz0123456789",
+			content:        ghToken2,
 			source:         "leaked.js",
 			wantMatchCount: 1,
 			wantContains:   "leaked.js",