fix: scrub 14 more Xray secret-detector false positives in deps

[dimittal]

The customer's Xray scan against cloud-drdroidlab:1.0.2 reported 25 "Plaintext API keys" / "Hardcoded secrets" violations under the block-exposures-high-critical rule. 14 of the 25 are addressable by extending the existing scrub block in this Dockerfile; the remaining 11 are genuine false positives in upstream code (public OAuth2 endpoint URLs, IETF/OASIS URNs, Kubernetes OpenAPI field-name maps, the Azure IMDS link-local IP) that require Xray ignore rules.

Scrubs added (each addresses one or more flagged lines, no runtime impact since none are read by the runtime image):

• find /build/deps -path '*.dist-info/RECORD' -delete → drops 5 violations (setuptools×3, datadog_api_client, awscli RECORD files flagged for SHA-256 hash content matching "plaintext API key" heuristics; RECORD is only used by pip uninstall / pip show --files).
• find /build/deps/kubernetes -type f \( -name '*_test.py' -o -name 'test_*.py' \) -delete → drops 1 violation in kubernetes/config/incluster_config_test.py:153. Test fixtures with hardcoded sample tokens; the test files ship in the wheel but are never imported at runtime.
• sed 's/?token=ppEuaNXBW4//g' .../PyMySQL.../METADATA → drops 1 violation. CodeCov badge URL token in the package's long description.
• Extend requests_oauthlib/oauth1_session.py scrub: replace existing EXAMPLE_TOKEN_* / EXAMPLE_SECRET placeholders (plus the original raw RFC-5849 example tokens) with <oauth_token> / <client_secret> style angle-bracket placeholders that the new scanner does not flag. Drops 4 violations on lines 225, 240, 273.
• oauthlib/oauth1/rfc5849/parameters.py:31 → replace 4 RFC-5849 example values (0685bd9184jfhq22, ad180jjd733klru7, signature, nonce) with angle-bracket placeholders. Drops 1 violation.
• oauthlib/oauth2/rfc6749/request_validator.py:332 → replace 'askfjh234as9sd8' and '23sdf876234' (RFC-6749 bearer-token example) with '<access_token>' / '<refresh_token>'. Drops 1 violation.
• google/auth/aio/credentials.py:92 → replace StaticCredentials(token="token123") docstring example with token="<token-value>". Drops 1 violation.

Verified in the rebuilt image:

• 0 RECORD files under /code/deps
• 0 test files under /code/deps/kubernetes
• 0 EXAMPLE_* literals in requests_oauthlib (32 angle-bracket placeholders instead)
• 0 occurrences of the CodeCov token in PyMySQL METADATA
• All flagged docstring lines now show angle-bracket placeholders

Trivy scan post-rebuild: 13 debian base HIGH (unchanged), 0 secrets, 0 python pkg vulns. No regressions.

Predicted customer impact: 25 → 11 violations. The remaining 11 are all in the same false-positive class as the existing 7 documented in the local Xray triage notes; they break into 3 clusters (Google auth URLs+URN, Kubernetes OpenAPI field-name maps, three standalone — Azure IMDS endpoint, AWS EKS prefix, Django auth label).