fix(detectors/ngrok): match API keys that do not start with 2

[mattbrady-1]

Summary

• Broaden the ngrok detector prefix from 2[a-zA-Z0-9]{26} to [a-zA-Z0-9]{27} so valid bearer tokens are detected regardless of first character.
• Allow suffixes of 20-21 alphanumeric chars with any leading character. Real authtokens (verified via ERR_NGROK_206) exist with 20-char and letter-leading suffixes, so a digit-leading 21-char suffix constraint drops valid secrets.
• Add tests for API keys not starting with 2, letter-leading and 20-char suffixes, and ak_ resource IDs, which are not secrets.

Test plan

• go test ./pkg/detectors/ngrok/ -run TestNgrok_Pattern
• Scan fixture containing a valid ngrok API bearer token and confirm verified detection

Made with Cursor

[github-actions]

Corpora Test Results

Scans a corpus of real-world public code against only the detectors changed in this PR, then compares unique match counts between the PR build and the main baseline to catch regex regressions. Verification is disabled — each detector's regex is measured independently.

0 new · 1 clean  |  Scoped to: ngrok

Status	Detector	Unique matches (main)	Unique matches (PR)	New	Removed
✅	ngrok	0	0	0	0

• 🔴 regression: >5 new, >20% increase over main, or any removed
• ⚠️ warning: 1–5 new and ≤20% increase over main
• ✅ clean
• 🆕 new detector (no baseline)

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 3fa132a. Configure here.}