fix(detectors/gitlab-v1): restrict keyword-to-secret gap to same line to stop Dockerfile false positives

[sergioperezcheco]

The GitLab v1 detector flagged a false positive on MAVEN_SETTINGS_PROFILE whenever a Dockerfile had a GITLAB_ACCESS_TOKEN ARG followed by an unrelated ARG MAVEN_SETTINGS_PROFILE=... line. Scans of such Dockerfiles (common in Java projects) produced findings on a value that is not a GitLab token at all.

Root cause: the detector built its pattern with the shared detectors.PrefixRegex(["gitlab"]), whose keyword-to-secret gap is (?:.|[\n\r]){0,40}?. That gap spans newlines, so the gitlab keyword on one line and a 20–22 character alnum/hyphen/equals/underscore candidate on a later line were matched together. MAVEN_SETTINGS_PROFILE is 21 characters and clears the 3.6 Shannon-entropy gate, so it was reported as a (unverified) GitLab token.

Fix: replace the shared prefix with an inline (?i:gitlab)[^\n\r]{0,40}? so the keyword and the captured candidate must sit on the same physical line. Single-line real matches such as GITLAB_TOKEN=<secret> are unchanged. The v2 and v3 GitLab detectors use the literal glpat- prefix and are not affected.

Added a regression test that reproduces the Dockerfile from the report: it fails on the old pattern (the candidate is matched across lines) and passes with the fix.

Fixes #4756

---

Note

Low Risk
Narrow regex tightening for false-positive reduction; v2/v3 detectors unchanged and verification logic is untouched.

Overview
GitLab v1 token detection no longer ties a gitlab keyword on one line to a token-like string on a later line.

The detector replaces shared PrefixRegex (gap could cross newlines) with (?i:gitlab)[^\n\r]{0,40}? so keyword and candidate stay on the same physical line. That stops Dockerfile-style false positives (e.g. GITLAB_ACCESS_TOKEN ARG followed by MAVEN_SETTINGS_PROFILE on the next line). Single-line matches like GITLAB_TOKEN=<secret> are unchanged.

A regression test covers the multi-line Dockerfile case and expects zero findings.

^{Reviewed by Cursor Bugbot for commit 29f01c5. Bugbot is set up for automated code reviews on this repo. Configure here.}