[INS-334] Octopus Deploy detector

[MuneebUllahKhan222]

Description

This PR adds the Octopus Deploy API Key Detector for TruffleHog.
It scans for Octopus Deploy API tokens (prefix API- with 29–34 uppercase alphanumerics) and optionally verifies them via the official API.

Regex: \b(API-[A-Z0-9]{29,34})\b

Verification

For verification, we use the Octopus Deploy Users API: /api/users/me. We send a GET request with the token in the X-Octopus-ApiKey: <token> header. A response code of 200 OK means the token is valid. 401 means it is invalid or revoked, and 403 means it is valid but has insufficient permissions.

This API endpoint is part of the official Octopus Deploy API and can be used safely for verification. It is read-only and does not perform any destructive actions.

Corpora Test

The detector does not appear in the list.

Checklist:

• Tests passing (make test-community)?
• Lint passing (make lint this requires golangci-lint)?

---

Note

Medium Risk
Adds a new detector that can make outbound HTTP verification calls to Octopus Deploy cloud instances; incorrect matching/verification behavior could impact scan performance or false-positive/negative rates.

Overview
Adds a new octopusdeploy detector that finds Octopus Deploy Cloud hostnames and API keys, emitting results keyed as url:token and optionally verifying tokens by calling GET /api/users/me with the X-Octopus-ApiKey header.

Registers the new detector in the default detector list and introduces a new DetectorType_OctopusDeploy enum value in proto/detectors.proto (with regenerated detectors.pb.go). Includes unit, integration, and benchmark coverage for matching and verification error handling.

^{Reviewed by Cursor Bugbot for commit 8e4cb9b. Bugbot is set up for automated code reviews on this repo. Configure here.}

[amanfcp]

LGTM!

A couple of non-blocking comments..

[shahzadhaider1]

Let's add the detector to the engine defaults as well

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.