[INS-406] Braintrust detector

[MuneebUllahKhan222]

Description

This PR adds the Braintrust API Key Detector for TruffleHog.
It scans for Braintrust API keys (prefix sk-) and optionally verifies them via the official API.

Regex: \b(sk-[A-Za-z0-9]{48})\b

Verification

For verification, we use the Braintrust Projects API: https://api.braintrust.dev/v1/project?limit=1. We send a GET request with the token in the Authorization: Bearer header. A response code of 200 OK means the token is valid. 401 Unauthorized means it is an invalid or revoked token, while 403 Forbidden indicates a valid token with insufficient permissions.

This API endpoint is part of the official Braintrust API and can be used safely for verification. It is read-only and does not perform any destructive actions.

Corpora Test

The detector does not appear in the list.

Checklist:

• Tests passing (make test-community)?
• Lint passing (make lint this requires golangci-lint)?

---

Note

Medium Risk
Adds a new detector that performs outbound HTTP verification calls to Braintrust’s API and extends the shared detector-type enum, which could impact scan behavior and downstream consumers if the new verification semantics or enum value are mishandled.

Overview
Adds a new braintrust detector that identifies sk--prefixed Braintrust API keys via regex, deduplicates matches, and redacts findings.

Introduces optional online verification by calling Braintrust’s GET /v1/project?limit=1 with a bearer token and treating 200/403 as valid and 401 as invalid, plus new unit/integration tests and a benchmark covering match and verification error scenarios.

Registers the detector in the default detector set and adds a new protobuf enum value DetectorType_BrainTrustApiKey so results can be categorized consistently.

^{Written by Cursor Bugbot for commit aa7eec3. This will update automatically on new commits. Configure here.}

[shahzadhaider1]

This detector has a single credential

[shahzadhaider1]

The Description() text is surfaced to customers in the enterprise UI, so mentioning "This detector identifies..." can be a bit confusing in that context. The pattern we follow is:

1. First sentence: What the service/platform is.
2. Second sentence: What risk the exposed credential poses.

Something like: "Braintrust is an AI evaluation and observability platform. Braintrust API keys can be used to access and manage projects, experiments, and evaluation data."
(Feel free to adjust the second sentence based on what the key actually grants access to.)