fix(redact): keep literals out of the code-call exemption

The call-expression exemption accepted any argument text, so api_key = decode(c2stbGl2ZS1hYmM) or PASSWORD = Pa55w0rd(x) kept the secret. Accept only digit-free identifiers and member references in callee and argument position.