feat: secret patterns for all of a repo's config files, with per-type overrides

providers.repos.secretPatterns (keys, values) apply to every config file
type; spring.secretPatterns overrides them list by list. A repo's
.lazysecrets.yaml takes the same layout. Each list comes from the first
that sets it: the repo's for the type, the repo's, the config's for the
type, the config's, the defaults.

Replaces the unreleased providers.repos.spring.keys/values.

internal/config/config_test.go

@@ -84,7 +84,8 @@ func TestLoadRejectsMistakes(t *testing.T) {
 		"workspace":  "sharing:\n  key: \"{{secrets/team/env-share}}\"\n",
 		"short keys": "sharing:\n  keyRules:\n    minLength: 8\n",
 		"classes":    "sharing:\n  keyRules:\n    minClasses: 5\n",
-		"regexp":     "providers:\n  repos:\n    spring:\n      keys: [\"(pass\"]\n",
+		"regexp":     "providers:\n  repos:\n    secretPatterns:\n      keys: [\"(pass\"]\n",
+		"spring re":  "providers:\n  repos:\n    spring:\n      secretPatterns:\n        values: [\"(\"]\n",
 	} {
 		if _, err := LoadAll([]string{write(t, content)}); err == nil {
 			t.Errorf("%s: no error", name)