Fix false positive secret detection and verbose output extraction

[derekmisler]

Resolves https://github.com/docker/agentcatalog/issues/36

Summary

• Fix false positive secret detection when reviewing PRs that contain security patterns (e.g., changes to secret-patterns.sh)
• Improve output extraction to filter out verbose agent "thinking" content

Changes

False Positive Fix (security/sanitize-output.sh)

When reviewing PRs containing security scanning code, the regex patterns themselves would trigger false positives. For example, the literal string 'ghs_[a-zA-Z0-9]{36}' in a diff would match the grep pattern.

Now the scanner:

• Extracts each match and verifies it doesn't contain regex metacharacters ([]{}()*+?^$\)
• Skips matches that appear within single quotes (quoted patterns in code)

Verbose Output Fix (action.yml)

Added filters to remove agent internal content from extracted output:

• msg= log messages
• --- Agent: / --- Tool: markers
• <thinking> / </thinking> XML tags
• [thinking] / [/thinking] bracket tags
• Thinking: prefixed content

Tests (tests/test-security.sh)

Added two new test cases:

• Test 14: Regex pattern in output → correctly NOT flagged
• Test 15: Real GitHub server token → correctly detected