feat: add tokens-credentials slice

[TacoRocket]

Summary

• add the Phase 2 tokens-credentials slice with operator-first token and credential surface correlation
• fix the Phase 2 review findings by decoupling web workload identity coverage from env-vars rows and making tokens-credentials finding IDs unique per surface
• align resource-trusts fixture mode with the live composed path and keep that command scoped to trust-relevant findings only

Validation

• python3 -m pytest
• python3 -m ruff check src/azurefox tests scripts