config.secret_in_env misses credentials embedded in connection strings (DSNs)

[cognis-digital]

Summary

config.secret_in_env (in configaudit.py) only flags an env value when it
matches a known token shape (_ENV_SECRET) or the key name looks
secret-ish. A high-entropy literal under a generic key name — e.g.
{"DATABASE_URL": "postgres://user:S3cr3tP@ss@host/db"} — is not flagged, and
embedded credentials in connection strings are a common real-world leak.

Impact

Medium false-negative. Config files sync to disk/cloud; a DSN with an inline
password leaks exactly like an API key. Today only key-name or token-prefix
heuristics catch it.

Suggested fix

Add a connection-string / scheme://user:pass@host detector to the env-value
scan (and reuse it for the manifest scan), being careful to still honor the
existing env-reference negative (${VAR} / $VAR / %VAR%) so we don't create
false positives on templated values.

Notes

Keep the redaction behavior (only a short prefix of the secret is shown in the
finding message) — see the existing config.secret_in_env message construction.