[Feature] Implement customizable secret redaction patterns

[HenryParker37-VIP]

Currently, the redaction engine (src/redact.js) uses static regular expressions to scrub standard credential signatures (such as ghp_ tokens).

We want to allow users to add custom target identifiers for redaction. To prevent developers from storing actual secret values inside configuration files, we will support only:

• Environment variable names to search and redact.
• Safe key-name patterns (e.g. redacting values of any key containing "secret").
• Optional custom regular-expression patterns.

Redaction applies only to the recorded evidence representation:

• stdout
• stderr
• stored command arguments
• environment metadata

ReproSpec must never modify or redact the actual command arguments before executing the captured command, because that could change program behavior.

Acceptance Criteria:

1. The command is executed with its original arguments, while only the persisted evidence copy is redacted.
2. Any invalid custom regular expression must be safely rejected during configuration validation.
3. Matching values must be redacted from stdout, stderr, and command argument lists.
4. No actual secret values may be written to the config file.
5. Documentation must explicitly warn that redaction is best-effort and does not guarantee that every credential is caught.