chore(deps): update pre-commit hook mongodb/kingfisher to v2.1.0

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
mongodb/kingfisher	repository	minor	v2.0.0 → v2.1.0

Note: The pre-commit manager in Renovate is not supported by the pre-commit maintainers or community. Please do not report any problems there, instead create a Discussion in the Renovate repository if you have any questions.

---

Release Notes

mongodb/kingfisher (mongodb/kingfisher)

v2.1.0

Compare Source

• Added GitHub App authentication for GitHub organization scans. Configure
  KF_GITHUB_APP_ID, KF_GITHUB_APP_INSTALLATION_ID, and either
  KF_GITHUB_APP_PRIVATE_KEY or KF_GITHUB_APP_PRIVATE_KEY_PATH to let Kingfisher
  sign short-lived App JWTs and mint a fresh installation token immediately before
  each repository clone, allowing scans to run beyond GitHub's one-hour installation-token
  lifetime. A complete App configuration takes precedence over KF_GITHUB_TOKEN, which
  continues to support personal access tokens and pre-minted installation tokens. #​488
• Further improved read-only AWS and GCP blast-radius role-impact analysis, included by default. AWS maps
  direct and one-hop assumable IAM roles; GCP maps impersonatable service accounts, inherited
  roles, and hierarchy scopes. Reachable roles and their policy grants are preserved in JSON,
  TOON, SARIF, and HTML reports/viewers.
• Added direct single-finding blast-radius mapping with kingfisher blast-radius --rule <RULE> <SECRET>, including stdin and component variables. Exposed Blast Radius Cmd in all report formats, aligned pretty output labels, and documented JSON/jq command extraction in the defender workflow.
• Added HTTPS Basic Auth validation for Betterleaks' generic-credential-uri rule. Kingfisher
  sends credentials only after an unauthenticated request receives an explicit Basic challenge;
  plaintext HTTP and endpoints without authoritative authentication evidence remain inconclusive.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Only on Saturday (* * * * 6)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.