spike: wire secrets detection runtime plugin

[gandhipratik203]

Summary

This is an experimental spike to wire the Rust-native secrets detection plugin from IBM/cpex-plugins#148 into the data-plane runtime CPEX path.

It adds a feature-gated secrets-detection-plugin dependency, registers SecretsDetectionFactory directly with CpexRuntimeRegistry, and documents a Redis runtime config for manual testing. The spike only targets the currently supported data-plane hooks: cmf.tool_pre_invoke and cmf.tool_post_invoke.

Validation

• cargo +1.96 check -p contextforge-gateway-rs --features secrets-detection-plugin
• cargo +1.96 test -p contextforge-gateway-rs-cpex
• cargo +1.96 test -p contextforge-gateway-rs-lib --test gateway_plugins -- --nocapture
• cargo +1.96 test -p contextforge-gateway-rs --features secrets-detection-plugin --test secrets_detection_e2e -- --ignored --nocapture

Notes

• The plugin must be compiled into the gateway binary; Redis config only activates the already-registered factory.
• Prompt/resource hooks are out of scope for this spike because data-plane currently rejects non-tool CPEX hooks.
• The binary E2E is ignored by default because it starts redis-server, a test MCP backend, and the real gateway binary.
• This depends on the local experimental PR148 crate path and is not intended as a production-ready dependency shape.