Scrubber: residual over-redaction of public OAuth/OIDC metadata keys and prefilter gaps #40

Follow-ups from the review of #30 (not leaks, only over-redaction / documented gaps):

• OIDC discovery-style keys are still treated as secrets by the shared key matcher: end_session_endpoint, check_session_iframe, id_token_signing_alg_values_supported (and the encryption siblings), pushed_authorization_request_endpoint. Consider matching on whole-word stems or a small public-metadata allow-list.
• The byte prefilter that skips records with no candidate has no needle for verifier-style keys; the documented "false means nothing to scrub" guarantee should be restated or the needle added.
• Expose the scrubbing and rate-limiting options through the C API (see the C API follow-up issue).
• Consider a per-signature repeat counter on the first admitted report instead of only a global suppressed count.

🤖 Generated with Claude Code