fix(rules): Java new String("literal") and other constructor wrappers are not flagged #630

False negative: String password = new String("hunter2hunter2xx") — the scanner regex needs a token of 8+ chars right after '=' and new is too short (older gap; the classifier already treats new String(..) as a literal). Other wrappers (Cow::Owned, Box::from, Python str("..")) are not recognised as literals and are suppressed as expressions in code files.

From the #627 review (KNOWN_GAPS rows in src/engine/secret_heuristics_tests.rs; current behaviour is pinned there).