chore: exclude synthetic conformance fixtures from secret scanning

[carles-grafana]

What this PR does

Follow up on #7881 with two exact-path exclusions for fixtures in the pending secret-detection feature:

• tools/secrets-conformance/testdata/legacy.json: a corpus explicitly marked scope: synthetic, containing provider-format test values and public examples.
• tools/secrets-conformance/synthetic_audit_test.go: includes the synthetic manually assigned GitLab registration token in TestManuallyAssignedGitLabRegistrationToken; the test documents that the value is never submitted.

GitHub push protection still blocks the feature commit on these two files after the catalog exclusion. The displayed findings identify Slack, webhook, Stripe, and GitLab fixture values. This change excludes only those two files, not the conformance directory or all Go tests. Production code remains covered.

Verification and limitations

• Reviewed both files in the feature branch for fixture context.
• Parsed the configuration as YAML and checked that all five locations in the latest rejection match an exclusion.
• Checked that neighboring conformance source files, other fixture files, and production paths remain outside the exclusions.
• GitHub still hides 11 additional detections. Their paths are not available, so this PR does not claim to resolve every remaining rejection.
• No application behavior changed; application tests were not run. The feature push was not retried.

As with #7881, merge this configuration into the default branch first. Forks receiving the feature push must also sync the configuration to their own default branch.

[Copilot]

🟢 Approval recommended

The configuration changes are narrowly scoped and have no unresolved review issues.

Pull request overview

Adds narrowly scoped secret-scanning exclusions for synthetic conformance fixtures while keeping production paths covered.

Changes:

• Excludes the synthetic legacy corpus.
• Excludes the synthetic audit test.
• Retains scanning for other paths.

File summaries

File	Summary
.github/secret_scanning.yml	Adds two exact-path fixture exclusions.

Review details

• Files reviewed: 1/1 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[carles-grafana]

The secret-detection feature is being amended to remove tools/secrets-conformance and tools/secrets-benchmark. These two conformance fixture files will no longer be included, so their additional secret-scanning exclusions are no longer needed.