Add support for detecting and validating CastAI API tokens

[patrickpichler]

Fixes #4925

Description:

This PR adds a custom detector for CastAI API keys.

Checklist:

• Tests passing (make test-community)?
• Lint passing (make lint this requires golangci-lint)?

---

Note

Medium Risk
Adds a new network-verifying detector and a new DetectorType enum value, which can affect default scanning behavior and downstream consumers of detector type IDs. Risk is limited to detector plumbing plus an internal refactor using maps.Copy for AWS extra data merging.

Overview
Adds a new castai detector that finds castai_v1_... API tokens, optionally verifies them via X-API-Key calls against the US/EU CastAI endpoints, and reports the verifying endpoint in ExtraData.

Wires the detector into the default detector set and introduces the new DetectorType_CastAI (CastAI = 1048) in protobuf-generated enums. Includes unit, integration, and benchmark coverage for matching and verification error handling.

Also refactors AWS access key verification result merging to use maps.Copy instead of a manual map loop.

^{Reviewed by Cursor Bugbot for commit e828423. Bugbot is set up for automated code reviews on this repo. Configure here.}

[CLAassistant]

All committers have signed the CLA.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Reviewed by Cursor Bugbot for commit e828423. Configure here.}

[cursor]

Verification breaks on first endpoint error, skipping alternatives

Medium Severity

When the first endpoint returns a transient error (timeout, 5xx), the loop breaks immediately without trying the remaining endpoint. A token valid on the EU endpoint would be reported as unverified with an error if the US endpoint happens to be temporarily unreachable, since the continue only fires for definitive 401 responses (!isVerified && verificationErr == nil).

 

^{Reviewed by Cursor Bugbot for commit e828423. Configure here.}