fix: reduce basic-auth false positives on Google Fonts CSS2 axis URLs

[AchieverSana]

Fixes #28. The regex allowed /, ?, # inside the credential segment, so query strings like css2?family=...wght@0,9..40,400 were misread as user:pass@host. Credential segments now exclude path/query/ fragment characters and whitespace.

Added a positive fixture (real embedded credentials still flagged) and a negative fixture (Google Fonts CSS2 axis URL no longer flagged).

Summary

• Fixes false positive where Google Fonts CSS2 variable-axis URLs (wght@0,9..40,400) were flagged as embedded basic-auth credentials
• Tightens generic-basic-auth-url regex to exclude / ? # \s from the credential segment
• Adds one positive and one negative test fixture

Type of Change

• New pattern (adds detection for a new secret type)
• Pattern improvement (reduces false positives/negatives)
• New agent adapter (adds support for a new AI agent)
• Bug fix
• Documentation
• CI/CD or tooling
• Other (describe below)

Checklist

• I have read CONTRIBUTING.md
• Pattern validation passes (node scripts/check-patterns.js)
• Tests pass (npm test)
• No real secrets are included in this PR
• Documentation is updated (if applicable)
• I understand maintainers may require CODEOWNER review before merge

Test Plan

Ran node scripts/check-patterns.js && npm test:

• 78 patterns valid, 0 errors
• 49/49 tests passed, including new fixtures:
  • matches real embedded credentials (https://admin:...@internal-api.example-corp.com/v1)
  • correctly rejects the reported Google Fonts CSS2 URL

Related Issues

Fixes #28

[tapheret2]

Review: fix: reduce basic-auth false positives on Google Fonts CSS2 axis URLs

Files: patterns/generic.json, tests/test-patterns.js
Size: +9 / -1

Notes

• Static pass on the patch: no obvious blockers from the diff alone.

Thanks @AchieverSana — independent review on the patch.