fix(enrichment): join adjacent added lines before secret-scan matching to catch cross-line-split secrets

[JSONbored]

Parent: #1936

Problem

review-enrichment/src/analyzers/secret-scan.ts (~line 61) matches each added diff line independently against the RULES regex list. A real credential split across two added lines — e.g. via string concatenation:

const part1 = "AKIAIOSFODNN7";
const part2 = "EXAMPLE";
const awsKey = part1 + part2;

— never appears as a single matchable token on either line, so no RULES regex fires even though the PR unambiguously ships a working AWS access key ID (or any other rule kind: github_token, slack_token, google_api_key, a private-key header split across lines, generic_secret_assignment — all use the same per-line matching and are all evadable the same way). Verified with a standalone regex test against the exact RULES patterns: the split reconstruction produces zero matches while the concatenated runtime value is a syntactically valid secret.

scanPatch/scanAddedLinesForSecrets is the only caller path (traced through secret/descriptor.ts) — there is no cross-line joining anywhere in the chain.

Fix

In addition to the existing per-line matching (keep it — it gives accurate line citations), also run the RULES regexes against a joined window of a few consecutive added lines per file (bounded, similar to how other analyzers window their scans) so a secret split across a short concatenation is still caught. Widen matching only — don't weaken the existing per-line detection or its line-citation accuracy.

Regression tests

• A secret split across two added lines via string concatenation is flagged.
• A secret split across two added lines that are NOT adjacent (e.g. separated by unrelated code) is correctly NOT flagged by the joined-window pass (bound the window).
• Existing single-line secret detection continues to pass unchanged.

[linear-code]

JSO-2460