[SizzleUnrlsd]

Summary

Second item of #71: hex digests no longer flood high-entropy-string.

• Acceptance tests first (test: define hex digests as non-secrets), implementation follows.
• plugins/secrets.py: looks_like_digest recognises a pure-hex value of digest length (MD5, SHA-1, SHA-256, SHA-512) or a hex value whose name names a hash (hash, digest, sha, checksum, commit, etag, fingerprint, revision, version). Subresource-integrity hashes (sha512-<base64>, the integrity field of lock files) and character-set constants (BASE62_ALPHABET, or any string whose characters are all distinct) are skipped too. The entropy rule skips those; a credential-like name still reports the value as hardcoded-credential, and hex of other lengths keeps the entropy rule. Python sources and configuration files follow the same rule.
• On the corpus measured in Scale: measure time and memory on projects of 30k to 100k lines #69: rich drops from 5 502 high-entropy-string findings to none, leaving its 4 real dangerous-eval; wagtail drops from 1 901 high-entropy-string findings, almost all integrity hashes of a package-lock.json, to one.
• Snapshots: healthchecks loses ALICE_HASH, a SHA-1 in a test, and MiniBookApiServer a 32-hex resource id in an Insomnia export; its two real Bearer tokens stay reported. One existing test that asserted the opposite is retargeted; the usage guide documents the rule.

Part of #71.