Detect Azure SAS tokens, SharedAccessKey connection strings, and Databricks PATs in CredentialLeakScorer #3468

Is your feature request related to a problem? Please describe.

CredentialLeakScorer currently checks for Azure Storage Key (AccountKey=...) and URI-based database connection strings (mongodb://, postgres://, etc.), and PR #3286 recently added OpenAI, Anthropic, and Hugging Face API keys.

However, when red-teaming agents or RAG pipelines deployed on Azure, several common Azure and AI platform credential formats are still missed by the default and Garak pattern sets:

1. Azure Shared Access Signature (SAS) tokens (sv=2022-11-02&...&sig=...), which are frequently leaked inside blob/container URLs or config snippets.
2. Azure Service Bus / Event Hubs / IoT Hub connection string keys (SharedAccessKey=...), which use semicolon-delimited key-value pairs rather than amqp:// URIs and use SharedAccessKey instead of AccountKey.
3. Databricks personal access tokens (dapi + 32 hex chars, with optional -<shard> suffix), commonly used in Azure Databricks and ML workflows.

Describe the solution you'd like

Add built-in regex patterns for these three formats to CredentialLeakScorer._DEFAULT_PATTERNS and CredentialLeakScorer.GARAK_PATTERNS (with (?P<credential>...) capture groups in GARAK_PATTERNS so from_excluded_values works as expected):

• Azure SAS Token: matches query strings starting with sv=20XX-XX-XX&... that include a base64/URL-encoded sig= parameter.
• Azure Service Bus / Event Hub Key: matches SharedAccessKey=<base64-key> without flagging SharedAccessKeyName=....
• Databricks API Token: matches dapi[0-9a-f]{32}(?:-[0-9])? with lookaround boundaries so partial or overlong hex strings are ignored.

Describe alternatives you've considered, if relevant

Users can pass custom regexes via CredentialLeakScorer(patterns=...), but having these in the default and Garak pattern sets makes out-of-the-box credential leak scoring much more useful for Azure and AI platform workloads.