feat: add HTTP request/response tracing support

[knqyf263]

Description

This PR adds a new --trace-http flag to enable HTTP request/response tracing for debugging purposes. It also renames the existing --trace flag to --trace-rego for clarity.

Key features:

• Renamed --trace to --trace-rego (with deprecated alias for backward compatibility)
• Added --trace-http flag for HTTP request/response tracing
• Enhanced secret detection using Trivy's built-in secret scanner
• Comprehensive redaction of sensitive data (auth headers, API keys, tokens, private keys)
• Binary content detection and redaction
• Colored output for better readability
• Internal flag (hidden from help output) for maintainer debugging only

Security Features

The --trace-http flag includes robust security measures:

• Advanced Secret Detection: Integrates Trivy's secret scanner to detect and redact private keys, tokens, and other sensitive data
• Pattern-based Redaction: Additional regex patterns for JSON, form data, and Bearer tokens
• Binary Content Protection: Automatically detects and redacts binary data
• Internal Flag: Hidden from normal help output to prevent accidental usage by end users

Usage information

# Enable HTTP tracing for debugging (maintainer only - flag is hidden from help)
$ trivy image --trace-http alpine:latest

# With other debugging options
$ trivy image --trace-http --debug --insecure my-image:tag

# Client/server mode
$ trivy image --server http://localhost:4954 --trace-http alpine:latest

# Works in CI environments for maintainer debugging
$ CI=true trivy image --trace-http alpine:latest

Security Note: The --trace-http flag is intended for maintainer debugging only. It is hidden from normal help output (Internal: true) and should be used with caution as it may expose sensitive information in trace output despite redaction efforts.

Before and After

Before

When debugging network issues or authentication problems, users had no visibility into HTTP requests/responses:

$ trivy image alpine:latest
2025-07-02T10:00:00.000Z	FATAL	image scan error: scan error: unable to initialize a scanner: unable to initialize an image scanner: GET https://registry-1.docker.io/v2/: UNAUTHORIZED

After

With --trace-http, maintainers can see detailed HTTP traffic with sensitive data properly redacted:

$ trivy image --trace-http alpine:latest

--- HTTP REQUEST ---
GET /v2/library/alpine/manifests/latest HTTP/1.1
Host: registry-1.docker.io
User-Agent: trivy/dev
Accept: application/vnd.docker.distribution.manifest.v2+json
Authorization: <redacted>

--- HTTP RESPONSE ---
HTTP/1.1 200 OK
Content-Type: application/vnd.docker.distribution.manifest.v2+json
Docker-Content-Digest: sha256:c5b1261d6d3e43071626931fc004f70149baeba2c8ec672bd4f27761f8e1ad6b

{
  "schemaVersion": 2,
  "mediaType": "application/vnd.docker.distribution.manifest.v2+json",
  "config": {
    "mediaType": "application/vnd.docker.distribution.container.image.v1+json",
    "size": 1472,
    "digest": "sha256:324bc02ae1231fd9255658c128086395d3fa0aedd5a41ab6b034fd649d1a9260"
  }
}

alpine (alpine 3.20.3)
======================
Total: 0 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 0)

Secret Redaction Example

When processing requests with sensitive data, secrets are automatically detected and redacted:

--- HTTP REQUEST ---
POST /api/keys HTTP/1.1
Host: api.example.com
Content-Type: text/plain

-----BEGIN RSA PRIVATE KEY-----
<redacted>
<redacted>
<redacted>
-----END RSA PRIVATE KEY-----
Normal text here

Also, the existing --trace flag has been renamed to --trace-rego for clarity:

# Before
$ trivy config --trace configs/

# After (both work, --trace is deprecated)
$ trivy config --trace-rego configs/
$ trivy config --trace configs/  # deprecated alias

Implementation Details

• Secret Scanner Integration: Uses Trivy's built-in secret scanner for advanced detection
• Memory Efficient: Optimized regex compilation and byte operations
• Internal Flag: Internal: true hides the flag from help output

Related issues

• Discussed in Enhance `--trace` flag to support HTTP request/response tracing alongside Rego policy tracing #9093

Checklist

• I've read the guidelines for contributing to this repository.
• I've followed the conventions in the PR title.
• I've added tests that prove my fix is effective or that my feature works.
• I've updated the documentation with the relevant information (if needed).
• I've added usage information (if the PR introduces new options)
• I've included a "before" and "after" example to the description (if the PR is a user interface change).

[DmitriyLewen]

LGTM
left 1 suggestion.

[DmitriyLewen]

We can use secret scanner here (we can add this (if required) in another PR).
wdyt?

[knqyf263]

Added in fa773aa

[simar7]

lgtm, left one comment.

[DmitriyLewen]

LGTM