Detect Hugging Face access tokens

[rgmz]

Description:

This PR adds a detection for Hugging Face access tokens.

Checklist:

• Does your PR pass tests?
• Have you written new tests for your changes?
• Have you lint your code locally prior to submission?

[zricethezav]

@rgmz slightly concerned here since it's using regexp directly instead of one of the predefined generated functions. Any reason this can't be something like:

Regex: generateSemiGenericRegex([]string{"hf_", "hugging"}, "hf_" + alphaNumeric("34")),

[rgmz]

Both generateSemiGenericRegex and generateUniqueTokenRegex make the pattern case-insensitive, which increased the number of false positives I encountered during testing. I also found several instances of the token that wasn't detected with the existing predefined regexes (e.g., " hf_token = \"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\"\n",).

That being said, I recognize that it's silly to hand-roll all the regexep boundaries on a per-rule basis. I was actually in midst of writing an issue describing how we could enhance the validation process by generation realistic scenarios that a secret could be found in. Currently the quality of test data for true & false positives varies based on rule, and would greatly benefit from a set of consistent test data rather than people adding new symbols in an ad-hoc untestable way that.

[zricethezav]

@rgmz would you mind resolving the conflicts? Happy to merge this after they have been resolved

[rgmz]

Done. The regex issue you mention needs to be revisited in the future; I've started some of the work in #1222.