fix(releases): secret scan skips UTF-16 BOM files outside text extensions #105

Problem

The release content scanner (apps/web/app/lib/releases/release-scan.ts) only decodes UTF-16 (BOM) files whose extension is in mustBeText. A UTF-16 BOM file with another extension (e.g. x.reg) is not decoded, so the secret scan misses credentials inside it.

Repro

Publish a release containing x.reg (UTF-16LE with BOM) holding a fake AWS access key id → state published, no findings. The same bytes named x.ps1 → quarantined (secret-aws-access-key-id).

Suggested fix

Decode any file starting with a UTF-16 BOM (within the scan size cap) for the secret scan, regardless of extension. Add a test.

Found during isolated review of #96 (pre-existing, not a regression).