Clean Core security audit findings

src/govoplan_core/security/http_fetch.py

@@ -41,7 +41,7 @@ def fetch_http(
     method: str = "GET",
     headers: Mapping[str, str] | None = None,
 ) -> HttpFetchResponse:
-    request = urllib.request.Request(
+    request = urllib.request.Request(  # noqa: S310 - URL is restricted to validated HTTP(S).
         validate_http_url(url, label=label),
         headers=dict(headers or {}),
         method=method,

src/govoplan_core/security/redaction.py

@@ -2,7 +2,7 @@ from __future__ import annotations
 
 import re
 from collections.abc import Mapping
-from typing import Any
+
 
 def sensitive_key_tokens(key: object) -> set[str]:
     value = str(key).strip()
@@ -40,7 +40,7 @@ def contains_plain_secret(value: object) -> bool:
         normalized_key = str(key).strip().casefold().replace("-", "_")
         if normalized_key in {"credential_ref", "secret_ref", "secret_reference"}:
             continue
-        if is_sensitive_key(key) and item not in (None, "", {"secret_ref": ""}):
+        if is_sensitive_key(key) and item not in (None, "", {"secret_ref": ""}):  # nosec B105 - empty redaction sentinels.
             return True
         if isinstance(item, Mapping) and contains_plain_secret(item):
             return True

src/govoplan_core/security/secrets.py

@@ -18,7 +18,7 @@ class SecretDecryptionError(RuntimeError):
     pass
 
 
-CAPABILITY_SECURITY_SECRET_PROVIDER = "security.secretProvider"
+CAPABILITY_SECURITY_SECRET_PROVIDER = "security.secretProvider"  # noqa: S105  # nosec B105 - capability identifier.
 
 
 @runtime_checkable