Add Pinecone API key detector

[dylanTruffle]

Adds a new detector for Pinecone vector database API keys (pcsk_* format).

Detection:

• Regex matches the pcsk_{label}_{secret} structure with tight bounds (5–6 char label, exactly 63 char secret, word boundaries), verified against real keys. This minimizes false positives and prevents over-reading when a key is adjacent to other alphanumeric text.
• The label is captured as a regex group and surfaced as ExtraData["key_id"] unconditionally, which maps to the key entry in the Pinecone console and aids revocation.
• SecretParts["key"] is populated on every result, satisfying the framework's checksecretparts static check.

Verification:

• Uses GET https://api.pinecone.io/indexes (non-state-changing, read-only) with Api-Key header auth and X-Pinecone-Api-Version: 2025-10.
• Validates response body structure (requires the top-level "indexes" JSON key), not just status codes, to be resilient against generic 200 responses from intermediate proxies.
• 200: Verified. Extracts project_id from the first index host, total_indexes, and metadata for up to 5 indexes (name, host, cloud, region).
• 401: Invalid key. Returned unverified with no VerificationError (documented behavior).
• 403: Valid key with restricted permissions (e.g. DataPlane-only roles). Marked as verified with permission=restricted metadata. Not documented in Pinecone's official API reference but observed in practice, since API keys can be created with custom permission scopes.
• 500 / other: Indeterminate. Returned unverified with a VerificationError so callers can retry.

Uses common.SaneHttpClient() with standard timeouts and io.LimitReader (1 MiB cap) on the response body. The verification endpoint is hardcoded (api.pinecone.io/indexes), so there is no user-controlled destination and the hardened no-local-addresses client is not needed. No SDK dependencies.

Tests:

• pinecone_test.go: regex coverage (valid/invalid shapes including too-short label, trailing alphanumerics, multi-key strings) plus table-driven tests for extractProjectID and mock-transport tests for verifyMatch (success, malformed indexes key, invalid indexes payload, metadata preservation on verification error).
• pinecone_integration_test.go (//go:build detectors): live-credential coverage for verified, unverified, not-found, timeout, and unexpected-API-surface cases.

Registered as DetectorType Pinecone = 1048.

Checklist:

• Tests passing (make test-community)?
• Lint passing (make lint this requires golangci-lint)?

---

---

Note

Medium Risk
Adds a new detector with outbound verification requests to Pinecone’s API; while scoped and read-only, mistakes could impact scan performance or verification accuracy via false positives/negatives.

Overview
Adds a new pinecone detector that identifies pcsk_... Pinecone API keys with a tightly-bounded regex, emits ExtraData["key_id"] and SecretParts, and optionally verifies keys by calling GET https://api.pinecone.io/indexes.

Verification now interprets 200/401/403 responses (including treating 403 as verified but permission-restricted), parses index metadata for extra context, and guards against malformed 200 bodies. The detector is registered in defaults and a new DetectorType_Pinecone enum value is added, with unit + integration tests covering pattern matching and verification edge cases.

^{Reviewed by Cursor Bugbot for commit 9d4cb70. Bugbot is set up for automated code reviews on this repo. Configure here.}

[CLAassistant]

All committers have signed the CLA.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 2295aba. Configure here.}

[MuneebUllahKhan222]

Nice work, especially the handling of ExtraData. LGTM. 🚀

[MuneebUllahKhan222]

This PR also closes issue-4641.🎯