Wraps the last byte of any literal credential in a character class.

gitleaks allowlists example keys by writing them out in full, so vendoring the config puts strings like a GCP key into our repository and GitHub's own secret scanning opens an alert for each one. The entries are regexes, so [7] and 7 are the same pattern and the allowlist keeps working, but the file no longer holds a contiguous literal for a scanner to match.

A shape upstream adds that is not listed here gets alerted on again, and the fix is another entry.