fix(detectors/auth0oauth): match Auth0 Private Cloud auth0app.com domains

[saghaulor]

Summary

• domainPat in the auth0oauth detector required the literal substring auth0.com, so it never matched Auth0 Private Cloud tenants' default managed domain (*.auth0app.com)
• Since FromData only emits a result when a client_id, client_secret, and a domain match are all present together, a leaked credential pair next to its real Private Cloud domain was silently dropped — no result, no verification attempt
• *.auth0app.com is Auth0's own documented default for Private Cloud tenants: https://auth0.com/docs/migrate-private-cloud-custom-domains
• Adds an optional, non-capturing app group so domainPat matches both *.auth0.com and *.auth0app.com
• Fully custom domains (e.g. login.example.com) have no learnable Auth0-related substring and remain out of scope
• Left a TODO on domainPat noting a pre-existing, unrelated regex quirk found while adding tests (bare domains with no leading character never match) — not fixed here since it's out of scope for this change

Test plan

• go test ./pkg/detectors/auth0oauth/... — all cases pass, including new regression cases for the Private Cloud domain match, a no-separator boundary case, and a negative case ensuring the optional group doesn't degrade into matching arbitrary .com domains
• go build ./..., go vet, gofmt -l — clean

🤖 Generated with Claude Code

---

Note

Low Risk
Scoped regex and test updates in the Auth0 OAuth detector only; no auth, verification, or API behavior changes beyond broader domain matching.

Overview
The Auth0 OAuth detector’s domain regex now accepts Private Cloud managed hosts ending in auth0app.com, not only auth0.com. Because findings require a matched domain alongside client ID and secret, leaks tied to *.auth0app.com were previously ignored entirely.

The pattern adds an optional app segment before .com so behavior for standard auth0.com tenants is unchanged. Comments document Private Cloud defaults and a pre-existing regex limitation (bare auth0.com / auth0app.com with no prefix still won’t match); that quirk is not fixed here.

Tests cover a typical Private Cloud domain, the existing word-boundary behavior for suffixes glued to a prefix (e.g. xauth0app.com), and a negative case so generic *.example.com domains are not matched.

^{Reviewed by Cursor Bugbot for commit 8367a30. Bugbot is set up for automated code reviews on this repo. Configure here.}