v1.1: feat: Pass path to detected card numbers in listener

Without the path, alerts for unmasked card numbers were unactionable as their
location in masked logs could not be determined. The listener now receives a
path (e.g., `products[1].ean`) to enable precise debugging.

The path is sanitized to prevent leakage of sensitive data that might be
present in key names, as these are client-controlled. Existing listeners
with two parameters continue to function.