refactor(newIDE/app): non-key-shaped API key placeholder

The previous placeholder started with 'AIzaSy' (the standard prefix for
Google API keys). SonarCloud's hardcoded-credential rules can flag this
even with the DUMMY marker in the middle of the string, which is what's
tripping the 'C Security Rating on New Code' gate on this PR.

Switch the fallback to a self-describing, non-key-shaped string:
'GD_FIREBASE_API_KEY-env-var-not-set-see-SECRETS.md'. The Firebase SDK
will reject it on first use, which is the same observable behaviour
operators get when they forget to set the env var — and we already
document this in SECRETS.md.

The apiKey-fingerprint test in ApiConfigs.spec.js still passes because
it asserts the placeholder is NOT one of the known leaked upstream
keys; we just updated the matching regex.

Also applied to Extensions/Firebase/tests/FirebaseExtension.spec.js
(test fixture, identical wording). The matching build artifact under
newIDE/app/resources/... is not tracked, so it picks up the change on
the next import-GDJS-Runtime run.

Verified:
  cd newIDE/app && npm test -- --watchAll=false --testPathPattern=ApiConfigs
  -> 4 passed (placeholder assertions updated)

Extensions/Firebase/tests/FirebaseExtension.spec.js

@@ -34,11 +34,13 @@ const variable = new gdjs.Variable().fromJSObject({
  * replace the placeholder with your own test-project key, e.g. via:
  *     export GD_TEST_FIREBASE_API_KEY="AIzaSy...your-key..."
  * The build pipeline will pick up GD_TEST_FIREBASE_API_KEY at test time.
+ * The placeholder is intentionally non-key-shaped so secret scanners
+ * don't flag it as a leaked credential.
  */
 const firebaseConfig = {
   apiKey:
     process.env.GD_TEST_FIREBASE_API_KEY ||
-    'AIzaSyDUMMY-UPSTREAM-OWNED-KEY-REPLACE-WITH-YOUR-OWN-XXXXXXXX',
+    'GD_TEST_FIREBASE_API_KEY-env-var-not-set-see-SECRETS.md',
   authDomain: 'gdtest-e11a5.firebaseapp.com',
   databaseURL: 'https://gdtest-e11a5.firebaseio.com',
   projectId: 'gdtest-e11a5',

newIDE/app/src/Utils/GDevelopServices/ApiConfigs.js

@@ -30,10 +30,11 @@ export const GDevelopFirebaseConfig = {
   // The Firebase Web API key is owned by the upstream project (4ian/GDevelop).
   // It must be supplied at runtime via the GD_FIREBASE_API_KEY env var.
   // See SECRETS.md at the repo root for the full list of required env vars.
-  // The string below is a clearly-marked placeholder and is NOT a real key.
+  // The string below is a clearly-marked placeholder and is NOT a real key;
+  // kept non-key-shaped so secret scanners don't flag it as a credential.
   apiKey:
     process.env.GD_FIREBASE_API_KEY ||
-    'AIzaSyDUMMY-UPSTREAM-OWNED-KEY-REPLACE-WITH-YOUR-OWN-XXXXXXXX',
+    'GD_FIREBASE_API_KEY-env-var-not-set-see-SECRETS.md',
   authDomain: 'gdevelop-services.firebaseapp.com',
   databaseURL: 'https://gdevelop-services.firebaseio.com',
   projectId: 'gdevelop-services',

newIDE/app/src/Utils/GDevelopServices/ApiConfigs.spec.js

@@ -57,8 +57,8 @@ describe('GDevelopFirebaseConfig (env-driven, no leaked keys)', () => {
     jest.isolateModules(() => {
       // eslint-disable-next-line global-require
       const { GDevelopFirebaseConfig: fresh } = require('./ApiConfigs');
-      expect(fresh.apiKey).toMatch(/^AIzaSyDUMMY/);
-      expect(fresh.apiKey).toMatch(/DUMMY|REPLACE|YOUR-OWN/);
+      expect(fresh.apiKey).toMatch(/GD_FIREBASE_API_KEY-env-var-not-set/);
+      expect(fresh.apiKey).toMatch(/not-set|REPLACE|SECRETS\.md/);
     });
   });