Fix silent secret leaks, add tests, CI and documentation

[Hotion13]

Security fixes (secrets previously leaking in clear text, most of them
not even flagged by the residual heuristic):

• message-digest-key / ntp authentication-key: when the key number was
  0/5/7/8/9, the generic inline "key " rule destroyed the "md5"
  token instead of the secret. The inline rule now refuses to match
  inside hyphenated directives (message-digest-key, pre-shared-key...)
  and runs last.
• snmp-server host: vrf/use-vrf/version 3 forms leaked the community
  string; replaced the two host rules with a single rule covering
  IOS/NX-OS/EOS keyword combinations, with a lookahead preventing
  keywords from being mistaken for the community.
• SNMPv3: NX-OS "priv 0x..." and "priv aes-128 " (hyphenated) as
  well as "auth sha-256" forms were not matched at all.
• crypto isakmp key: with an encryption type ("key 6 ") the
  type digit was destroyed instead of the secret.
• tacacs/radius-server: keys following auth-port/acct-port options were
  missed, as were bare "key " lines inside "radius server X" /
  "tacacs server X" blocks (key chain structure is preserved).
• HSRP/VRRP plain-text "authentication ", IS-IS isis password /
  area-password / domain-password, ip http client password,
  key config-key password-encrypt and EOS "username ... sshkey" were
  not covered.
• FQDNs (host.domain) leaked both identifiers because word boundaries
  rejected dots; hostname/domain replacement is now case-insensitive
  and matches inside FQDNs (numeric-only names keep strict boundaries).

Robustness improvements:

• IPv4 pool extended with 198.18.0.0/15 (RFC 2544) instead of mapping
  every address past ~760 to the same duplicate.
• Same MAC written aabb.ccdd.eeff / aa:bb:cc:dd:ee:ff now gets one
  alias; multicast/broadcast and well-known virtual MACs (HSRP, VRRP,
  GLBP) are kept; counter no longer wraps at 65535.
• Residual heuristic also flags hash-looking values ($1$/$6$/$9$...,
  long 0x blobs) even on partially sanitized lines, plus passwd/psk
  keywords.
• Friendly errors on unreadable input/output, --strict (exit code 2 on
  residual findings, CI-friendly) and --version flags.

Project structure:

• tests/test_sanitize.py: 58 stdlib-only unit tests, one regression
  test per fixed leak, plus CLI end-to-end tests.
• GitHub Actions workflow running the suite on Python 3.9 and 3.13.
• Real README (usage, options, guarantees, limits) and updated module
  docstring.

Co-Authored-By: Claude Fable 5 noreply@anthropic.com
Claude-Session: https://claude.ai/code/session_01Sra7y2NhqmvwkvWSB5Q5D4