[TESTING][PLUGINS]: Validate and harden secrets detection plugin

[lucarlig]

✅ Test Summary

Validate, load test, document, and harden the plugins/secrets_detection/ plugin so it is production-ready for 1.0.0. This covers gateway integration, bypass resistance, edge-case handling, documentation completeness, and operational behavior under load.

---

🧪 Test Type

Choose one or more applicable categories:

• Unit tests (Python)
• Integration / end-to-end tests
• Manual UI testing (admin panel)
• Transport coverage (HTTP, WebSocket, SSE, stdio)
• Federation / multi-gateway testing
• Configuration / environment-specific behavior
• Other (load, stress, and hardening validation)

---

🧬 Scope & Affected Components

Select what this test covers or validates:

• mcpgateway core (API logic, handlers)
• Admin UI (HTMX / Alpine / Tailwind)
• Tool/Resource/Prompt logic
• Federation sync/discovery
• Server interactions or SSE
• Auth / JWT / security flows
• Observability (logging, metrics)
• Makefile, shell scripts or CLI
• Containerized setup (Docker/Podman)
• Other (plugin framework behavior for plugins/secrets_detection/)

---

📋 Acceptance Criteria

What should pass or be verified?

• Existing unit tests for plugins/secrets_detection/ pass and cover core detection logic
• Integration tests validate the plugin inside the gateway pipeline with real tool calls
• Edge cases are covered: malformed input, empty payloads, unicode/binary content, and very large payloads
• Bypass resistance is validated for common evasion attempts (encoding tricks, chunking, obfuscation)
• Latency overhead is measured under normal load
• Stress testing covers 100+ concurrent tool calls with the plugin enabled
• Memory and CPU usage remain acceptable under sustained load
• Fail-open or fail-closed behavior is verified and documented
• README/config documentation is complete for configuration, examples, defaults, and limitations
• Input validation, error handling, and logging avoid leaks of sensitive data
• Secure defaults are confirmed for production use
• CI passes with no regressions

---

📓 Additional Context & Steps

This issue is a child of #3735 and narrows that broader validation effort to the Secrets Detection plugin only.

Suggested validation areas:

pytest tests -k secrets_detection
# Add or run integration coverage for plugin registration + execution path
# Run targeted load/stress validation with plugin enabled

Relevant references:

• plugins/secrets_detection/
• plugins/AGENTS.md
• plugins/config.yaml
• plugins/install.yaml

---

📎 Related PRs / Issues (optional)

Parent issue: #3735

[crivetimihai]

Good scope for hardening the secrets detection plugin. SHOULD for Release 1.0.0 — security plugins need thorough validation before GA.