feat: implement missing features per gap analysis

[pixincreate]

Type of Change

• Bugfix
• New feature
• Enhancement
• Refactoring
• Documentation

Description

This PR implements missing features from the original gap analysis against gitleaks/detect-secrets. See #71 for the set of planned features.

New Features

1. CRITICAL Severity Support — Added Critical variant to Severity enum (was silently downgraded to LOW)
2. Baseline Suppression — --baseline <path> suppresses known findings; --update-baseline merges new findings into existing baseline
3. Inline Suppression — keywatch:ignore comments suppress findings on that line
4. Per-Detector Allowlist — allowlist field with regex patterns to suppress false positives
5. Keyword Prefilter — keywords field for fast content filtering before regex execution
6. Entropy Threshold — entropy_threshold field to filter low-entropy matches on generic patterns
7. Parallel Scanning — File scanning parallelized via rayon
8. Stdin Scanning — --stdin reads from stdin instead of files
9. Git History Scanning — --git-history runs git log -p and scans patch output

Review Fixes

1. Baseline now merges on update (was replacing and losing history)
2. Baseline stores matched_content_hash instead of raw secrets (security)
3. Baseline fingerprint includes hash — changed secrets on same line now detected
4. Scanner uses find_iter() instead of find() — catches all matches per detector
5. PrivateKeyContentDetector fixed — uses (?s) flag for proper multiline matching
6. Added keywords to ~85 detectors and entropy thresholds to 5 generic detectors
7. Added 13 Indian fintech/brokerage detectors (Razorpay, Paystack, CRED, PhonePe, Paytm, Zerodha, Upstox, Groww, Angel Broking, ZebPay, CoinDCX, WazirX, Unocoin)

Code Quality

• Zero clippy warnings (cargo clippy --all-targets --all-features)
• Formatted with cargo +nightly fmt --all
• Public API unit tests moved to tests/ integration tests
• All 78 tests pass

Context

Closes #71.

How did you test it?

• cargo test — all 78 tests pass
• cargo clippy --all-targets --all-features — zero warnings
• cargo +nightly fmt --all — clean
• Manual testing of baseline workflow, stdin piping, and git history scanning

Checklist

• I formatted the code cargo +nightly fmt --all
• I addressed lints thrown by cargo clippy
• I reviewed the submitted code
• I added unit tests for my changes where possible

[Copilot]

Pull request overview

Implements multiple “gap analysis” scanning capabilities in KeyWatch, expanding both the detection configuration model and scan execution modes (stdin, git history, parallel file scanning), while adding suppression workflows (baseline + inline ignore) and new detector metadata (keywords/allowlist/entropy).

Changes:

• Added CRITICAL severity support end-to-end (parsing, reporting, exit code behavior, tests/docs).
• Implemented baseline suppression/update, inline suppression (keywatch:ignore), and per-detector allowlist/keywords/entropy filtering.
• Parallelized file scanning with rayon and added stdin + git history scanning paths.

Reviewed changes

Copilot reviewed 16 out of 19 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
typos.toml	Adds project-specific typos ignore rules.
tests/scanner_tests.rs	Updates scan-args construction; adds new integration tests for inline suppression/stdin/git history.
tests/report_tests.rs	Updates severity counting expectations for CRITICAL.
tests/detector_tests.rs	Adds tests for allowlist, keyword prefilter, and entropy threshold behavior.
tests/baseline_tests.rs	Adds baseline filtering/load/save/update tests (hash-based storage).
src/utils.rs	Removes a doc comment.
src/scanner.rs	Adds inline suppression, allowlist/keywords/entropy checks, chunked stream scanning, git history/stdin scanning, and rayon-based parallel file scanning.
src/report.rs	Adds CRITICAL severity and expands severity counts tuple.
src/lib.rs	Applies baseline filtering/update workflow and updates CLI warning output and exit-code logic.
src/detector.rs	Extends detector model with allowlist/keywords/entropy and implements keyword/entropy helpers.
src/cli.rs	Adds --stdin, --git-history, --baseline, --update-baseline, and scan-args validation.
src/baseline.rs	Introduces hashed baseline format with merge/update and filtering.
README.md	Documents stdin scan, git history scan, baseline usage, inline suppression, and updated exit-mode semantics.
justfile	Minor formatting/line-number normalization.
detectors.toml	Adds keywords/entropy metadata, fixes some patterns, and adds many new detectors.
CHANGELOG.md	Documents new features/fixes and behavior changes.
Cargo.toml	Adds rayon and sha2 dependencies.
Cargo.lock	Locks new dependency graph (rayon/sha2 and transitive deps).
.gitignore	Ignores /.omo.