fix(keychain): zero sensitive byte slices after use

[Benehiko]

Clear marshalled plaintext, decoded secrets, and cryptographic key material (DH shared secret, PKCS7-padded plaintext) immediately after use across the Linux, Windows, and secretservice backends.

[docker-agent]

Review Summary

Assessment: 🟢 APPROVE

This PR correctly implements zeroing of sensitive byte slices (plaintext, secrets, cryptographic keys) after use across Linux, Windows, and secretservice backends.

Analysis:

• ✅ defer clear() statements are correctly placed to execute on all return paths (normal and error returns)
• ✅ In the Filter() functions, manual clear() calls are used instead of defer, which correctly handle all normal and error return paths
• ✅ All sensitive data (marshalled plaintext, decoded secrets, DH shared secrets, PKCS7-padded plaintext) is properly cleared
• ✅ No resource leaks or logic errors detected

The implementation follows Go's defer semantics properly: deferred functions execute when the containing function returns, regardless of whether it's a normal return or an early error return. This ensures sensitive memory is zeroed in all code paths.

Verdict: The changes are secure and correctly implemented. No issues found.