[INS-406] Braintrust detector

[MuneebUllahKhan222]

Description

This PR adds the Braintrust API Key Detector for TruffleHog.
It scans for Braintrust API keys (prefix sk-) and optionally verifies them via the official API.

Regex: \b(sk-[A-Za-z0-9]{48})\b

Verification

For verification, we use the Braintrust Projects API: https://api.braintrust.dev/v1/project?limit=1. We send a GET request with the token in the Authorization: Bearer header. A response code of 200 OK means the token is valid. 401 Unauthorized means it is an invalid or revoked token, while 403 Forbidden indicates a valid token with insufficient permissions.

This API endpoint is part of the official Braintrust API and can be used safely for verification. It is read-only and does not perform any destructive actions.

Corpora Test

The detector does not appear in the list.

Checklist:

• Tests passing (make test-community)?
• Lint passing (make lint this requires golangci-lint)?

---

Note

Medium Risk
Adds a new detector that can make outbound HTTP requests to Braintrust for token verification, which may impact scan performance and behavior under network failures. Also extends the detector type protobuf enum, which can affect downstream consumers relying on stable enum values.

Overview
Adds a new Braintrust API key detector that finds tokens matching sk- + 48 alphanumerics, deduplicates matches, redacts output, and (optionally) verifies tokens via GET https://api.braintrust.dev/v1/project?limit=1 treating 200/403 as valid and 401 as invalid.

Registers the detector in the default detector list and introduces DetectorType_BrainTrustApiKey (1044) in proto/detectors.proto (and regenerated detectors.pb.go). Includes unit tests for the regex/keyword behavior plus integration tests/benchmarks covering verification success, invalid tokens, and verification error handling.

^{Written by Cursor Bugbot for commit 83c8446. This will update automatically on new commits. Configure here.}

[shahzadhaider1]

A couple of things to flag regarding the use of sk- as a detector keyword:

1. Keyword length: We generally avoid using prefixes as keywords unless they're at least 4-5 characters long or distinctive enough to avoid false positives. Since sk- is only three characters, it's better to rely on more specific, contextually relevant keywords instead.
2. False positive risk: The sk- prefix is shared across many different secret types, which means using it as a keyword would likely generate a high volume of false positives.

What do you think?