fix(oauth): scope repo JSON URL analysis to OAuth config keys (#164)

[hello-args]

Summary

• Skip data/, fixtures/, test_data/, processed/, and tests/ JSON during repo OAuth scans
• Extract URLs only from OAuth-related JSON keys (no regex scrape of arbitrary fields)
• Flag plaintext HTTP only when the URL is under an OAuth endpoint key

Test plan

• pytest tests/test_oauth_json_scope.py
• Scraped/non-OAuth HTTP URLs in JSON → no OAuth finding
• authorization_endpoint: http://... → still HIGH
• Existing typosquat regression test still passes

Made with Cursor