Sec fixes

[spacexnu]

• TextProcessor.replace_text() now treats search text literally, preventing regex-based redaction bypass/ReDoS risk.
• Added TextProcessor.replace_regex() and moved internal regex callers to it.
• spaCy model downloads are now opt-in with auto_download=True; default behavior fails with install guidance.
• spaCy download path now uses sys.executable instead of bare python.
• US SSN masking now handles hyphenated, spaced, and compact SSNs.
• Symmetric(cipher_key=...) now validates constructor-provided keys immediately.
• Docs/examples no longer print encryption keys.
• Optional spaCy tests now skip cleanly when the optional extra is not installed.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (94e7730) to head (2caef87).

Additional details and impacted files

@@            Coverage Diff            @@
##              main       #36   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files           20        20           
  Lines          507       564   +57     
=========================================
+ Hits           507       564   +57     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.