fix(rules): shell default literal inside interpolation is not flagged #629

False negative: DB_PASSWORD=${DB_PASSWORD:-hunter2hunter2xx} (a default literal inside ${..:-..}) is treated as a pure reference. Direction: split ${VAR:-default} / ${VAR:=default} and flag a secret-looking default.

From the #627 review (KNOWN_GAPS rows in src/engine/secret_heuristics_tests.rs; current behaviour is pinned there).