The redaction registry only replaced the exact stored value of a run's
own registrations. A bearer minted on one run and pasted into another
run's or issue's text stayed unmasked, and a row swept clear of its
material could no longer resolve any plain text to match against.
Add a second pass to the three read functions. It finds each
JWT-shaped candidate in the value, hashes it, and checks the hash
against the company's registry. A match needs no decryption, because
the candidate found in the text already is the plain text, so a row
whose material the sweep cleared still masks. The lookup scopes to
the company only, so it also covers a value pasted across runs and
issues. It batches its query over the whole candidate set instead of
querying once per run or per candidate.
Co-authored-by: Paperclip <noreply@paperclip.ing>
