fix(tier3): prevent false positives in network exfiltration checks

[kweinmeister]

Summary

Fixes false positives in the network exfiltration security check.

The previous check relied on broad substring matching across the entire command string. As a result, benign commands were frequently flagged as security risks. For example:

• Using standard curl flags like curl -f -sS or curl -sSf (which lowercase-matched -F form uploads).
• Piped or chained utilities like grep -F, awk -F, or unzip -d /tmp following a download.
• URLs or package names containing words like post, put, or --format=json (e.g. /blog/posts/123, cloud-storage-fuse).

This PR tightens the check so it only triggers on actual exfiltration attempts:

• Anchors commands to avoid matching package names or URLs as the network binary.
• Scopes arguments to their specific command segment so piped or chained commands don't trigger flags.
• Distinguishes case-sensitive upload flags (-F, -d, -T / --upload-file) from safe options (-f, -Follow).
• Reliably detects secrets passed in query strings or headers (e.g. Authorization: Bearer $TOKEN).
• Keeps the standalone Harbor evaluation template (eval.py) in sync and adds regression tests covering both safe and unsafe command patterns.

Verification

• I am familiar with the Contributing Guidelines
• Added or updated focused tests
• Updated documentation for user-visible changes
• Ran make lint
• Ran make test
• Ran make build
• Did not add credentials, private datasets, or proprietary benchmark content

Release Impact

• No user-visible release note needed
• Updated CHANGELOG.md