Bump trufflehog to 3.95.5, stop removing .git/index in sanitize_git_repo

[liquidsec]

Summary

• Bump trufflehog from 3.90.8 to 3.95.5
• Stop removing .git/index during repo sanitization

Trufflehog 3.95.5 clones local file:// repos before scanning (their fix
for malicious git config execution, PR trufflesecurity/trufflehog#4502).
BBOT's sanitize_git_repo() was removing .git/index, which broke this
clone step. The index file is binary metadata (filename-to-SHA mappings)
with no execution path, so leaving it in place has no security impact.
The actual attack vectors (.git/config, .git/hooks/) remain sanitized.

[github-actions]

🚀 Performance Benchmark Report

⚠️ No current benchmark data available

This might be because:

• Benchmarks failed to run
• No benchmark tests found
• Dependencies missing

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 90%. Comparing base (404bbbc) to head (8286bc0).

Additional details and impacted files

@@          Coverage Diff          @@
##             dev   #3176   +/-   ##
=====================================
- Coverage     90%     90%   -0%     
=====================================
  Files        449     449           
  Lines      43953   43950    -3     
=====================================
- Hits       39291   39288    -3     
  Misses      4662    4662           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.