fix(discovery): redact joined credential arguments

[pengyuzhang]

What type of PR is this? (check all applicable)

• Bug Fix

Related issue: N/A (reported directly)

What changed?

• Redact joined short-option credential operands such as -pPASSWORD and -HAuthorization.
• Redact credential-like key=value arguments even when they do not start with a dash.
• Preserve noncredential assignments such as --port=8080 and profile=production.
• Add regression coverage for the reported bypasses and negative cases.

Why?

Discovery previously handled separated credential operands and dashed flag=value forms, but common CLI conventions could leave credential values in collected process argv.

Thank you to Syed Anas Mohiuddin, independent security researcher, for reporting the gap and recommending coverage for joined short options and key=value arguments.

How did you test it?

• .venv/bin/pytest -q (234 passed)
• .venv/bin/ruff check .

Potential risks

Credential-key matching is intentionally conservative and may redact some values whose key contains a credential term. Joined handling is limited to the existing short credential flags to bound over-redaction.