feat: Spring Boot config files in repos

application*.properties/.yml and bootstrap* files tracked by git are
listed under Repos, with their secret-looking keys as secrets.

- Keys whose name ends like a secret (password, secret, token, key, …)
  or whose value looks like one (Jasypt ENC(...), a URL or connection
  string with a password) are listed; providers.repos.spring.keys and
  .values replace the patterns, also in a repo's .lazysecrets.yaml.
- A file's details count the keys left out; ${VAR} values are marked
  as references, and a tracked file is only marked red when a listed
  value is in plain text.
- Later YAML/properties documents name their keys after the profile:
  spring.datasource.password (prod).
- Maven's @placeholders@ parse; Argo CD's applications.yaml and Helm
  templates aren't Spring files.
- A green leaf icon, themeable with springColor.

internal/ui/app/favourites.go

@@ -101,11 +101,14 @@ func (m Model) containerRender(withSource bool) func(styles.Styles, provider.Con
 		n := st.Node(storeKey(c))
 		line := c.Name
 		if c.Source.Kind == provider.KindRepo {
-			// A secret file: a lock for an encrypted one, a file in the
-			// warning colour for plain text, and its type after it
-			// ("sops · age", "env · plain text").
+			// A secret file: a lock for an encrypted one, a leaf
+			// for Spring config, a file in the warning colour for plain
+			// text, and its type after it ("sops · age", "env · plain text").
 			icon, style := iconSet.Encrypted, sty.KindRepo
-			if !strings.HasPrefix(c.Detail, "sops") {
+			switch {
+			case strings.HasPrefix(c.Detail, "spring"):
+				icon, style = iconSet.Spring, sty.Spring
+			case !strings.HasPrefix(c.Detail, "sops"):
 				icon, style = iconSet.PlainFile, sty.Warning
 			}
 			if icon != "" {