v3.4.0

Added

• leak audit --sarif FILE writes the audit findings as SARIF 2.1.0 for GitHub code scanning. Each finding points at the file it concerns (the tracked secret file, the code that reads environment variables, the exact Dockerfile line, the first commit with a secret) and carries a severity, so critical findings rank as High. The GitHub Action passes sarif-file through in audit mode too.
• Bitbucket Cloud and Azure DevOps in leak audit-org: --bitbucket <workspace> (with BITBUCKET_TOKEN, an access token) and --azure-devops <org>[/<project>] (with AZURE_DEVOPS_PAT). Forks and disabled repositories are skipped, and a listing error exits 4 instead of reporting an empty organisation as clean. As everywhere else, tokens reach curl and git on standard input or through the environment, never as command-line arguments.