Only create SourceFile for leak on demand

[sigurdm]

Timing each LeakPattern and the creation of SourceFile separately in a repo with a single 150MB file of random bytes revealed this:

AWS Access Key: 190 ms
AWS Secret Key: 1434 ms
Google API Key: 143 ms
Google OAuth ID: 337 ms
Google OAuth Refresh Token: 244 ms
Google OAuth Access Token: 97 ms
Private Key: 169 ms
RSA Private Key: 156 ms
EC Private Key: 179 ms
PGP Private Key: 227 ms
creating source files: 45777 ms

With this change, leak detection for big files will look like:

Publishing _dummy_pkg 0.0.1-toobig to https://pub.dev:
├── CHANGELOG.md (<1 KB)
├── LICENSE (<1 KB)
├── README.md (<1 KB)
├── pubspec.yaml (<1 KB)
└── testfile (146 MB)
Validating package... (14.3s)
Package validation found the following errors:
* Potential leak of Private Key in testfile at offset 153600000:153600106.
  
  ```
  -----BEGIN PRIVATE KEY-----
  H0M6xpM2q+53wmsN/eYLdgtjgBd3DBmHtPilCkiFICXyaA8z9LkJ
  -----END PRIVATE KEY-----
  ```
  
  Add a git-ignore style pattern to `false_secrets` in `pubspec.yaml`
  to ignore this. See https://dart.dev/go/false-secrets

[jonasfj]

Passing around sourceFileCache like this is an ugly hack.

Just remove the span() function. This isn't used many places.. Then have the place the prints LeakMatch instances do your hack. If that's what you want.

---

It might also be reasonable not to compute SourceFile when the file is sufficient large.

It might be reasonable to detect binary files and not do SourceSpan for such files.

---

Or maybe a factory constructor on SourceFile that returns a _LazySourceFile which lazily computes the line numbers.

class _LazySourceFile implements SourceFile {
  final Iterable<int> _decodedChars;
  final Object? _url;
  late final _sourceFile = SourceFile.decoded(_decodedChars, _url);

  _LazySourecFile(this._decodedChars, this._url) {
    // TODO: Some cheap validations of _url and _decodedChars, just handle cases where
    //       SourceFile.decoded would throw.
  }

  @override
  int get lines => _sourceFile.lines;

  // TODO: All other overrides...
}

[sigurdm]

I removed the cache, and now only create the sourcefile when "describe"ing the leak.

That way we might create sourcefile multiple times for the same file, but as we at most display 3 leaks it should not be a problem.

I also implemented a limit on when we are creating the sourcefile. Above that we don't attempt to display line numbers, but just offsets.