inspect additional sensitive data carriers

[dyson-025]

Description

Extends SensitiveDataFilter to inspect additional value carriers while preserving existing behavior.

Changes

• Inspect dictionary keys in addition to dictionary values.
• Inspect bytes and bytearray by decoding them before applying the filter.
• Traverse set and frozenset recursively like other container types.
• Added regression tests covering each newly supported carrier.

Related Issues

Closes #48

Type of Change

• Bug fix (non-breaking change fixing an issue)
• Documentation update
• New feature
• Refactoring / performance optimization

Verification Checklist

• Tests pass (pytest)
• Code formatted with ruff format
• Lint passes with ruff check

[higagan]

Verified this locally — the code is right, and thanks for cutting the kwarg-name and fail-closed parts as discussed. Scope is exactly what we agreed.

All five carriers now block, and ordinary calls still work (int, float, Path, callbacks pass through untouched, so nothing breaks):

dict KEY (JSON-native)  -> BLOCKED
bytes / bytearray       -> BLOCKED
set / frozenset         -> BLOCKED
ordinary scalar call    -> ran

102 tests pass, ruff check clean. Decoding bytes with errors="ignore" is the right call — it can only join characters, never split a keyword, so it fails safe.

One thing left before merge: the README Limitations section still says

only str, list, tuple, and dict values are inspected

which your PR makes untrue. That's the last unchecked box on #48. Could you update it to match — something like:

only str, bytes, list, tuple, set, and dict keys and values are inspected

Once that's in, this is good to merge.

(Two unrelated things I hit while reviewing, both pre-existing on main and not yours: ruff format --check flags cli.py/test_scan.py, and cyclic input raises RecursionError. Filed separately.)

[higagan]

@dyson-025 — still happy to merge once the README Limitations line is updated to match the new coverage. That's the only thing outstanding.

[dyson-025]

just wait 1 hour i will fix this.