Add Tailscale detector

[marwan-at-work]

Description:

This PR adds a new Tailscale detector for API and Oauth tokens

Fixes #1712

Checklist:

• Tests passing (make test-community)?
• Lint passing (make lint this requires golangci-lint)?

[CLAassistant]

All committers have signed the CLA.

[zricethezav]

@marwan-at-work Thanks for submitting this PR! I love Tailscale :)

One of the engineers will review this PR. In the meantime, would you mind resolving the merge conflicts?

[willnorris]

we probably don't want to just limit to these prefixes. There are quite a few: https://tailscale.com/kb/1277/key-prefixes/. But we also may add more later, so maybe just a regex for the key type as well?

[willnorris]

oh! I guess these are the only two that will work with the oauth/verify endpoint. In that case, we may actually want to rethink how we implement the key checking endpoint on the Tailscale side 😕

[marwan-at-work]

We ended up with a new endpoint that should verify everything? Updated the regex to reflect it

[marwan-at-work]

@zricethezav thanks for the kind words. Resolved the conflicts and the PR is ready for review :)

[ahrav]

Thanks a lot @marwan-at-work, I know you spent a decent amount of time getting this ironed out and we really appreciate the contribution. Similar to Zach, I am also a huge Tailscale fan!

[bugbaba]

Hi @marwan-at-work,

Just wanted to double-check about the /secret-scanning/verify endpoint. I noticed that it isn't documented and it appears to be a unique endpoint created specifically for trufflehog, which seems a bit unusual.

It would be better to have a more general endpoint that could be utilized to verify the validity of the token.

[marwan-at-work]

@bugbaba this is going to be a general endpoint for all secret scanning products that don't require a specific implementation besides validating a token (as opposed to GitHub for example, which requires specific public key verification, request/response body shapes, etc).

A more generic endpoint that I saw in other implementations is to hit a /profiles endpoint but being overly cautious from a security prospective, we'd like to not return any profile or user identifiers besides just a boolean about the requested token. Of course, if the token is valid, actors can hit other endpoints that retrieves more information but some implementation might permit us to revoke the token before that can happen and we currently don't have a /profile endpoint anyway without knowing more information like the tailnet that this token belongs to.

As for documentation, this endpoint is end customers would care about, but it's something we'll discuss for sure.

Thanks