scanner: reduce HTTP client false positives with context-aware checks

[yuliuyi717-ux]

Summary

• add targeted tests for legitimate fetch / axios / node-fetch usage on safe domains
• add context-aware allowlist logic for EXFIL_FETCH_DYNAMIC so normal API client traffic is not flagged as high-risk exfiltration
• tighten CRED_FILE_READ matching so process.env access is not misclassified as sensitive file reads
• keep obfuscated exfil detection intact with explicit regression coverage

Verification

• cd scanner && npm test
• cd scanner && npm run build

Fixes #2

[vercel]

@yuliuyi717-ux is attempting to deploy a commit to the Rapi's projects Team on Vercel.

A member of the Team first needs to authorize it.