feat: Spring Boot config files in repos

application*.properties/.yml and bootstrap* files tracked by git are
listed under Repos, with their secret-looking keys as secrets.

- Keys whose name ends like a secret (password, secret, token, key, …)
  or whose value looks like one (Jasypt ENC(...), a URL or connection
  string with a password) are listed; providers.repos.spring.keys and
  .values replace the patterns, also in a repo's .lazysecrets.yaml.
- A file's details count the keys left out; ${VAR} values are marked
  as references, and a tracked file is only marked red when a listed
  value is in plain text.
- Later YAML/properties documents name their keys after the profile:
  spring.datasource.password (prod).
- Maven's @placeholders@ parse; Argo CD's applications.yaml and Helm
  templates aren't Spring files.
- A green leaf icon, themeable with springColor.

docs/config.md

@@ -74,6 +74,7 @@ theme:
   azureColor: ["#82aaff"]
   databricksColor: ["#ff757f"]
   repoColor: ["#c099ff"]
+  springColor: ["#c3e88d"]               # Spring Boot config files
 ```
 
 A role lazysecrets doesn't know, a typo or one from a newer version, is

docs/keys.md

@@ -53,7 +53,7 @@ match case exactly.
 | `Y` | copy the reference (`@Microsoft.KeyVault(...)`, key/certificate URL, `{{secrets/scope/key}}`) |
 | `v` | versions of the selected item (Azure); `space`/`y`/`Y` then act on that version; `esc`, `⌫` or `v` to go back |
 | `o` | open the selected item in the browser (over SSH: copy the link) |
-| `e` | open the selected SOPS or `.env` file, or a secret's file at its line ([how](repos.md#opening-files)) |
+| `e` | open the selected SOPS, `.env` or Spring file, or a secret's file at its line ([how](repos.md#opening-files)) |
 | `s` / `S` | copy a [link](sharing.md) to the selected item / share menu (also env files, [encrypted](sharing.md#sharing-env-files)) |
 | `ctrl+o` | open a link or reference (or just paste one) |
 | `x` | [custom commands](custom-commands.md) |

docs/repos.md

@@ -1,9 +1,9 @@
-# SOPS and .env files in git repos
+# SOPS, .env and Spring files in git repos
 
 lazysecrets shows git repositories under **Repos**: their
 [SOPS](https://github.com/getsops/sops)-encrypted files (YAML, JSON,
-`.env`, INI) and plain env files as vaults, and the keys in them
-(`db.password`, `list[0]`) as secrets. A dot or bracket inside a key is
+`.env`, INI), plain env files and [Spring Boot config](#spring-boot-config)
+as vaults, and the keys in them (`db.password`, `list[0]`) as secrets. A dot or bracket inside a key is
 escaped, `app\.name`, so it doesn't read as nesting.
 
 ## Which repos
@@ -46,7 +46,7 @@ Folders of dependencies and caches are never looked in, tracked or not:
 3. where the repo's `.sops.yaml` `creation_rules` say SOPS files go,
 4. the whole repo.
 
-`include`/`exclude` apply to env files too.
+`include`/`exclude` apply to env and Spring files too.
 
 ```yaml
 providers:
@@ -65,6 +65,43 @@ sharing:
   key: https://kv-team.vault.azure.net/secrets/env-share   # or its lazysecrets:// link
 ```
 
+## Spring Boot config
+
+`application.yml`, `application-prod.properties`, `bootstrap.yaml` and the
+like, tracked by git (not those in a Helm chart's `templates/`). Most of
+their keys aren't secret, so only those that look like one are listed:
+
+- **keys** named like a secret: ending in `password`, `pwd`, `secret`,
+  `token`, `key`, `credentials`, `salt`, `connection-string` and the
+  like (`spring.datasource.password`, `client-secret`, `checkoutKey`),
+- **values** that look like one: Jasypt's `ENC(...)`, a URL with a
+  password (`jdbc:postgresql://app:pw@db/app`), or a connection string
+  with `AccountKey=`, `SharedAccessKey=` or `Password=`.
+
+A file's details count the keys left out, and `e` opens it whole. A
+`${DB_PASSWORD}` value is marked as a reference: the secret is set
+elsewhere. A tracked file is marked in red only when a listed key has its
+value in plain text.
+
+Each list of regexps replaces its default; `keys: [".*"]` lists every key:
+
+```yaml
+providers:
+  repos:
+    spring:
+      keys: ["(?i)(password|secret|token|key)$", "bearer$"]   # matched against the key's name
+      values: ["^ENC\\(.+\\)$"]                               # and against its value
+```
+
+A repo's `.lazysecrets.yaml` can set `spring` too, for everyone, and wins
+over the config, one list at a time.
+
+Keys are named as Spring names them, `spring.datasource.password`; in a
+file with several documents (`---`, or `#---` in `.properties`), a later
+document's keys get its profile, `spring.datasource.password (prod)`.
+Values Maven fills in at build time (`@project.version@`) are read as
+they are.
+
 ## Decrypting
 
 Listing never decrypts: SOPS encrypts values only, so keys and metadata