Add SOC 2 secrets template

[martsokha]

Summary

Ships `PolicyTemplate::Soc2Secrets` — a bulk-erase policy scoped to elide's credential-family labels:

• `api_key` — service/provider API keys (AWS, Stripe, GitHub, generic)
• `auth_token` — bearer, session, refresh tokens
• `private_key` — PEM and OpenSSH private material
• `crypto_address` — wallet receive/send addresses; included as credential-adjacent since a leak points at production assets under the org's control

Framework fit is broad: covers SOC 2 Trust Services Criteria CC6.1 (logical access) and CC6.7 (transmission/disposal), and satisfies ISO 27001 A.9.2.4 (secret authentication information management) — same label set.

Unlike HIPAA `§164.514`, SOC 2's Common Criteria do not enumerate a fixed identifier list; the scope reflects industry-standard secrets-scanning practice rather than framework text. Callers whose evidence workflow needs richer coverage (JWTs embedded in log lines, session IDs) extend the returned `PolicyDefinition`'s labels and group before submission.

Behavior

• Wired into `TemplateCatalog::builtin()` so discovery endpoints surface it alongside the existing regulatory templates.
• Wire shape: `{"kind": "soc2_secrets"}` — no options.
• 4 new tests: scope covers every credential label, scope excludes personal-data labels, erase rule targets the group, template ids are stable.

Test plan

• `cargo fmt --all --check`
• `cargo clippy --workspace --all-features --all-targets -- -D warnings`
• `cargo test --workspace --all-features --all-targets` (37 template tests pass)
• `RUSTDOCFLAGS=-D warnings cargo doc --workspace --all-features --no-deps`
• `cargo machete`

🤖 Generated with Claude Code