[INS-410] Added batch token detector

[MuneebUllahKhan222]

Description

This PR adds the HashiCorp Vault Token Detector.
It scans for various types of HashiCorp Vault authentication tokens (including standard service tokens, periodic tokens, and legacy tokens) and associated Vault server endpoints. The detector supports live verification against the custom endpoints.

Token Regex: \b(hvb\.[A-Za-z0-9_.-]{50,300})\b

Endpoint Regex: (https?:\/\/[^\s\/]*\.hashicorp\.cloud(?::\d+)?)(?:\/[^\s]*)?

Verification
Verification is performed by sending a GET request to the Vault server's auth/token/lookup-self endpoint using the detected token in the X-Vault-Token header.

A response code of 200 OK indicates the token is valid. In this case, the detector extracts and returns metadata about the token to assist with remediation, including:

• Policies: The permissions associated with the token.

• Entity ID: Useful for identifying the identity/owner and revoking the token.

• Attributes: orphan and renewable status.

A response code of 401 Unauthorized or 403 Forbidden indicates the token is invalid or has been revoked.

This verification is safe as lookup-self is a read-only metadata operation that does not consume secrets or trigger state changes within the Vault cluster.

Corpora Test

The detector does not appear in the list.

Checklist:

• Tests passing (make test-community)?
• Lint passing (make lint this requires golangci-lint)?

---

Note

Medium Risk
Adds a new detector that performs live HTTP verification against user-discovered Vault endpoints; mistakes in regex matching or endpoint handling could increase false positives/negatives or cause unexpected outbound requests during scans.

Overview
Adds a new HashiCorpVaultBatchToken detector that finds hvb. batch tokens, extracts accompanying *.hashicorp.cloud Vault endpoints, and (optionally) verifies tokens via GET /v1/auth/token/lookup-self using the X-Vault-Token header while attaching token metadata to results.

Wires the detector into default engine detector lists and updates protobuf DetectorType enums (plus engine tests) so the new detector is recognized and treated as having no cloud endpoint. Includes unit tests, an integration test using stored secrets, and a benchmark for FromData.

^{Written by Cursor Bugbot for commit 8710f1c. This will update automatically on new commits. Configure here.}