secret-sentryccdwyer/secret-sentryTwo-way secret scrubbing: redacts credentials before the model sees them and blocks writing them into tracked files or shell commands