mongodb/kingfisher v2.1.0 on GitHub

[v2.1.0]

Added GitHub App authentication for GitHub organization scans. Configure
KF_GITHUB_APP_ID, KF_GITHUB_APP_INSTALLATION_ID, and either
KF_GITHUB_APP_PRIVATE_KEY or KF_GITHUB_APP_PRIVATE_KEY_PATH to let Kingfisher
sign short-lived App JWTs and mint a fresh installation token immediately before
each repository clone, allowing scans to run beyond GitHub's one-hour installation-token
lifetime. A complete App configuration takes precedence over KF_GITHUB_TOKEN, which
continues to support personal access tokens and pre-minted installation tokens. #488
Further improved read-only AWS and GCP blast-radius role-impact analysis, included by default. AWS maps
direct and one-hop assumable IAM roles; GCP maps impersonatable service accounts, inherited
roles, and hierarchy scopes. Reachable roles and their policy grants are preserved in JSON,
TOON, SARIF, and HTML reports/viewers.
Added direct single-finding blast-radius mapping with kingfisher blast-radius --rule <RULE> <SECRET>, including stdin and component variables. Exposed Blast Radius Cmd in all report formats, aligned pretty output labels, and documented JSON/jq command extraction in the defender workflow.
Added HTTPS Basic Auth validation for Betterleaks' generic-credential-uri rule. Kingfisher
sends credentials only after an unauthenticated request receives an explicit Basic challenge;
plaintext HTTP and endpoints without authoritative authentication evidence remain inconclusive.