New audit: secret leakage

[woodruffw]

By default, secrets in the secrets.* context are redacted in logs, etc. However, if a secret is JSON, this kind of pattern can accidentally disclose it:

${{ fromJSON(secrets.oopsie).foo.bar }}

This happens because secrets.oopsie is redacted, but substrings/arbitrary decodings of secrets.oopsie are not.

As such, we should probably detect any flow of fromJSON(secrets).attr.access or fromJSON(secrets.abc).attr.access and flag it.

Doing this fully generally is a little tricky, since expressions can appear literally almost anywhere. So the existing audit infrastructure might be insufficient for this; instead we probably need an audit_raw(body: &str) or similar.