fix(CW-7503): the committed secret scrubber did not compile; own the block type

`d1fd6f1a31` landed `session_secret_scrub.rs` with a borrow the compiler
rejects: `block_type` borrowed `map` immutably, and the two following
`get_mut` calls need it mutably, so the crate did not build.

The block type is now an owned `String` read once before the mutations, which
is the smallest change that keeps the behaviour identical: the same two
branches, the same `tool_use`/`server_tool_use` test, the same redaction calls.

Found while compiling the review slice on top of it; committed separately so
the security slice and the review slice stay reviewable on their own.

Checks: `scripts/dev-cargo.sh check -p codewhale-tui --lib` clean;
`scripts/dev-cargo.sh test -p codewhale-tui --lib tools::review` = 86 passed,
0 failed.

Refs CW-7503

crates/tui/src/session_secret_scrub.rs

@@ -341,8 +341,9 @@ fn scrub_value(value: &mut Value, secrets: &[String]) -> usize {
     match value {
         Value::Object(map) => {
             let mut changed = 0;
-            let block_type = map.get("type").and_then(Value::as_str);
-            if block_type == Some("tool_result") {
+            // Owned, so the two `get_mut` calls below can borrow the map.
+            let block_type = map.get("type").and_then(Value::as_str).map(str::to_string);
+            if block_type.as_deref() == Some("tool_result") {
                 if let Some(Value::String(content)) = map.get_mut("content") {
                     changed += usize::from(scrub_text(content, secrets));
                 }
@@ -356,7 +357,7 @@ fn scrub_value(value: &mut Value, secrets: &[String]) -> usize {
                     }
                 }
             }
-            if matches!(block_type, Some("tool_use" | "server_tool_use"))
+            if matches!(block_type.as_deref(), Some("tool_use" | "server_tool_use"))
                 && let Some(input) = map.get_mut("input")
             {
                 let redacted = crate::client::redact_json_model_bound_text(input, secrets);