fix(diff-scope): authoriz/authenticat mid-word and a leading oauth are auth paths (granted fix round, GST-1065)

Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>

bin/gstack-diff-scope

@@ -129,17 +129,19 @@ _session_data() {
 }
 
 # An auth path holds a token, split the way lib/review-risk.ts tokens() splits
-# paths (camelCase, then every non-alphanumeric run), that starts or ends with
-# auth (GST-1065): auth.ts, /auth/, authn, authz, auth0, authguard, oauth,
-# basicauth, nextauth, oauth2 and authorize match; a token starting with author
-# (author-spec.md, AUTHORS, authority.ts) does not unless it is authoriz*.
+# paths (camelCase, then every non-alphanumeric run), that names auth
+# (GST-1065): authoriz or authenticat anywhere in it (unauthenticated,
+# deauthorize), oauth at its start (oauth2client), or auth at its start or end
+# (auth.ts, /auth/, authn, authz, auth0, basicauth, nextauth). A token starting
+# with author (author-spec.md, AUTHORS, authority.ts) is not auth, and oauth
+# inside a word (coauthors) is not either.
 _auth_path() {
   local s="$1" t r=1
   while [[ "$s" =~ ^(.*[a-z0-9])([A-Z].*)$ ]]; do s="${BASH_REMATCH[1]} ${BASH_REMATCH[2]}"; done
   shopt -s nocasematch
   for t in ${s//[^a-zA-Z0-9]/ }; do
     case "$t" in
-      authoriz*|oauth2) r=0; break ;;
+      *authoriz*|*authenticat*|oauth*) r=0; break ;;
       author*) ;;
       auth*|*auth) r=0; break ;;
     esac