feat(vuln): encrypted oauth2-proxy credential for the CVE page

Generated through pipes and encrypted to the repo's public age recipient; values never echoed.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

platform/vuln-scanner/vuln-scanner-oauth2-proxy-credentials.sops.yaml.example

@@ -9,7 +9,8 @@
 #
 # Regenerate (encrypts to the repo's public recipient via .sops.yaml, values never echoed):
 #   ./infra/devcontainer/dev.sh run bash -c '
-#     cs=$(openssl rand -hex 32); ck=$(openssl rand -base64 32 | tr -- "+/" "-_")
+#     cs=$(python3 -c "import secrets; print(secrets.token_hex(32))")
+#     ck=$(python3 -c "import base64,os; print(base64.urlsafe_b64encode(os.urandom(32)).decode())")
 #     sops -e --input-type yaml --output-type yaml \
 #       --filename-override platform/vuln-scanner/vuln-scanner-oauth2-proxy-credentials.sops.yaml \
 #       /dev/stdin <<YAML > platform/vuln-scanner/vuln-scanner-oauth2-proxy-credentials.sops.yaml