fix: suppress the false alert on AWS batch logging

[catinspace-au]

CodeQL flags the per-secret error log in the AWS provider's batch fetch as clear-text logging of a secret. It isn't one. Code scanning alert #23 (py/clear-text-logging-sensitive-data) at src/scalo/secrets/providers/aws.py:645.

• The flagged value is SecretId. CodeQL treats any .get() keyed on a name containing "secret" as sensitive, and BatchGetSecretValue fills SecretId with the name or ARN the caller asked for. An Errors entry holds SecretId, ErrorCode and Message, never a SecretString.
• The flagged argument now carries CodeQL's codeql[py/clear-text-logging-sensitive-data] suppression comment, with that reason, on the line above it.
• New test runs a partial batch failure through the moto emulator with a known fake value and asserts that no scalo log record, at any level, carries it. Adding the batch response to the log makes it fail.
• The alert will NOT close at merge on its own. This repo runs CodeQL default setup, and its SARIF (main and this PR, CodeQL 2.27.1) carries 43 rules and no py/alert-suppression query, so nothing reads the comment. Closing feat: version check on by default with app-supplied endpoint defaults #23 needs a dismissal or a scanning workflow that honours suppressions.