Replace aho-corasick library

[zricethezav]

A bug was discovered in the community slack channel when a npm token was not being detected. This was due to the fact that the existing ahocorasick library does not properly implement overlapping matches (see related issue here: petar-dambovaliev/aho-corasick#12).

To test this bug try running an unverified scan on the follow content:

npm_token = "00000000-0000-0000-0000-000000000000"

You'll see it does not detect a secret. This is because npm_ is currently taking precedence over the npm keyword due to

trufflehog/pkg/engine/engine.go

Line 156 in 93c561f

MatchKind: ahocorasick.LeftMostLongestMatch,

. However, changing this to StandardMatch does not fix it even though the library says it should support overlapping matches.

Testing this on a few example repos yields pretty similar performance results

[semvis123]

petar-dambovaliev/aho-corasick#13
The previous library should be fixed with the above mentioned pull request.
From my testing this library will consume way less memory, while the other library is slightly faster on larger inputs. If you want to prioritize memory usage you might want to consider switching back. But I recommend to run some benchmarks first.

[zricethezav]

@semvis123 sounds good with me. Would you mind opening a PR for this change on our fork so you can get credit for your work? https://github.com/trufflesecurity/aho-corasick

Thanks!

[semvis123]

Done 👍