feat(vuln): encrypted oauth2-proxy credential for the CVE page

Generated through pipes and encrypted to the repo's public age recipient; values never echoed.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

platform/vuln-scanner/README.md

@@ -31,7 +31,7 @@ In one PR (the realm import does not re-run on its own for a NEW client):
 
    ```bash
    ./infra/devcontainer/dev.sh run bash -c '
-     cs=$(openssl rand -hex 32)
+     cs=$(python3 -c "import secrets; print(secrets.token_hex(32))")
      sops set platform/keycloak/keycloak-realm-clients.sops.yaml \
        "[\"stringData\"][\"vuln-scanner-client-secret\"]" "\"$cs\""
      sops set platform/vuln-scanner/vuln-scanner-oauth2-proxy-credentials.sops.yaml \