Add NuGet.org API Key secret extractor and validator

[Amsamms]

Summary

Implements a secret extractor and validator for NuGet.org API Keys, addressing issue #1734.

• Secret type: NuGet.org API Key (prefix oy2, 46 characters total)
• Risk: Leaked keys allow attackers to publish, update, or unlist .NET packages on NuGet.org, enabling supply chain attacks
• Detection: Regex-based detector matching oy2 followed by 43 alphanumeric characters
• Validation: PUT request to https://www.nuget.org/api/v2/package with X-NuGet-ApiKey header — valid keys return 400 (Bad Request, no package body), invalid keys return 401/403

Files added

File	Description
veles/secrets/nugetorgapikey/nugetorgapikey.go	Secret struct (NuGetOrgAPIKey) with Token field
veles/secrets/nugetorgapikey/detector.go	Regex detector using simpletoken.Detector
veles/secrets/nugetorgapikey/detector_test.go	True positive/negative tests + acceptance tests via velestest.AcceptDetector
veles/secrets/nugetorgapikey/validator.go	HTTP validator using simplevalidate.Validator
veles/secrets/nugetorgapikey/validator_test.go	Mock HTTP server tests for valid/invalid/error cases + context cancellation

Registration

• Detector registered in extractor/filesystem/list/list.go
• Validator registered in enricher/enricherlist/list.go
• Proto registration skipped (requires .proto file changes and code regeneration)

References

• Closes PRP: Secret extractor for NuGet.org API Key #1734
• Pattern: https://learn.microsoft.com/en-us/nuget/nuget-org/scoped-api-keys
• NuGet Server API: https://learn.microsoft.com/en-us/nuget/api/overview

Test plan

• All detector tests pass (acceptance, true positives, true negatives)
• All validator tests pass (valid key, invalid key, server errors, context cancellation)
• Registration files compile successfully
• CI passes

🤖 Generated with Claude Code

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

[Amsamms]

Hi team — this NuGet.org API Key extractor has been open for 2 weeks with all CI checks green (including CLA). Would appreciate a review when you get a chance. Thanks!

[Amsamms]

Friendly weekly ping — this NuGet.org API Key extractor PR is now 3 weeks old with all 13 CI checks green (CLA included). Happy to address any review feedback. Thanks!