Merge origin/main into redact-2

Resolve the security doc against main's provider-shape and Authorization header text. Run main's new Authorization detection before the branch's '=' gate in detectCredentialValues, which otherwise skipped every 'Authorization:' header. Drop the branch's containsFoldASCII in favor of main's identical helper, and move the fingerprint version to 9 (main and the branch both reached 8 independently).