fix: avoid mcp030 critical from prose

[slegarraga]

Closes #9.

Splits MCP030 evidence into two signals:

• a sensitive pattern in the resource URI remains critical
• an unambiguous file pattern in the name/description is reported as high
• generic prose such as "no credentials" no longer produces a finding

Adds regression tests for both cases and updates the rule description.

Verified with npm run typecheck and npm test (49 passed).

[royalpinto007]

Closing this PR.

The author is no longer an active contributor on these repositories, so this cannot be carried through review or iterated on.

The underlying issue stays open and is available for anyone who wants it. If you were looking at this change, please do open a fresh PR, it is very welcome.