fix(pe3): distinguish OAuth token nouns from access actions

[rng1995]

Summary

• classify noun-shaped access token / access tokens terminology in documentation without relying on a small OAuth lifecycle allowlist
• retain PE3 findings for imperative/modal access instructions, sensitive credential sources, and read/copy/send/exfiltration actions
• handle Markdown tables, headings, later clauses, URL navigation, action inflections, and HTTP POST token flows
• add benign and adversarial regression coverage based on real OAuth documentation patterns

Root cause

PE3's generic access ... tokens? expression cannot distinguish the verb phrase “access tokens” from the compound noun “access token.” The existing documentation exception required a narrow lifecycle keyword and modifier list, so glossary entries, OAuth return values, revocation behavior, storage guidance, and supported-token tables still surfaced as HIGH-severity credential-access findings.

Impact

Ordinary OAuth terminology in documentation no longer produces PE3 findings. Actionable credential access remains detected, including attacks placed in documentation or adjacent to otherwise benign OAuth prose.

Validation

• uv run pytest -q tests/unit/test_patterns.py tests/nodes/analyzers/test_binary_and_pe3_filtering.py tests/nodes/analyzers/test_static_runner_filtering.py — 204 passed
• uv run pytest -q --ignore=tests/unit/test_input_handler.py --ignore=tests/unit/test_input_handler_ssrf.py — 2,158 passed, 13 skipped, 4 xfailed
• uv run ruff check src/ tests/
• uv run ruff format --check src/ tests/

The unfiltered test run completed with 2,199 passes and seven environment-specific failures in the two DNS/SSRF input-handler test files because public GitHub/GitLab hosts resolve to internal addresses on this network; the changed PE3 code is not involved.