fix(security): add Groq, xAI and OpenAI-compatible key shapes to the credential catalog

[diegosouzapw]

Fixes the privately reported GHSA-r4q7-7f24-m29p.

CREDENTIAL_PATTERNS (open-sse/utils/credentialPatterns.ts) is the single catalog both the
opt-in credential-masker guardrail and the public error sanitizer iterate. It had no entry for
Groq or xAI, and only knew the exact 48-char OpenAI sk- form.

Measured on the release tip before this change

Shape	Public sanitizer	Guardrail
Groq gsk_ + 52	leak	leak
xAI xai- + 80	leak	leak
DeepSeek sk- + 32 hex	redacted	leak
sk- + 20 / 36 / 40 / 51 (not 48)	redacted	leak
Kimi/Moonshot sk- + 48	redacted	redacted (coincidental exact-48 match)

Each shape was probed bare, inside a sentence and inside a JSON error body. The advisory says
both layers leak every sk- variant — that part is overstated: the public path already caught
all of them through STRONG_CREDENTIAL_TOKEN. For the sk- family the exposure was the guardrail.

Change

• groq and xai entries after anthropic_alt.
• A generic openai_compatible sk- fallback as the last entry. Order matters: both consumers
  replace as they iterate, so openai_proj / openai / anthropic* stamp their specific label
  first and the fallback only sees shapes nothing else claimed. Its lookbehind mirrors
  STRONG_CREDENTIAL_TOKEN, so words like risk-… do not match.
• All three regexes are a fixed prefix plus one bounded character class — linear, no nested
  quantifiers.

Validation (TDD)

Check	Result
New guardrail cases (per shape × 3 contexts, label ordering, negatives) — on the tip	red
Same cases after the fix	41 / 41
Wider catalog / sanitizer suites	367 / 368 — see note
typecheck:core, check:open-sse-typecheck	clean
eslint + prettier (pre-commit)	clean

Note on the one red: sanitizers.property.test.ts → terminates on long adversarial input (ReDoS guard) hit 3034 ms while five validation runs were in parallel on a box at load average
57. Benchmarking sanitizeErrorMessage on the untouched tip and on this branch gave
indistinguishable times, and those times do not grow with input length (1 000 → 20 000 chars),
which is the opposite of what ReDoS looks like. The test input (aaa@bbb.com 111) also matches
none of the three new patterns.

Out of scope, left as follow-ups

• tskey-auth-… (Tailscale) was never in the catalog.
• The guardrail does not decode \uXXXX escapes the way the public path does.

⚠️ base-red inherited: #12732 — failures outside the catalog and sanitizer suites come from the tip.