Redact streamed secrets across chunk edges

// before: chunks redacted independently; "sk-ab" + "cd12" passes through
out.write(redact(chunk));

// after: hold back a tail that could still begin a secret
buf += chunk;
const safe = lastSafeCut(buf, secrets);   // no partial or straddling match before it
out.write(redact(buf.slice(0, safe)));
buf = buf.slice(safe);