fix(secmem-lint): match receivers and params by object, not by name

[deadpoets]

Both remaining secmem-lint findings were one root cause: the pass matched by
name and AST shape where it should match by types.Object.

• reentrancy.go:27 (MEDIUM) — R1 required the receiver to be a plain
  identifier, so it silently did nothing for s.buf.WithBytes(...). A struct
  field is how most programs hold a buffer, so the check was off for the common
  case. Receivers are now compared as identity chains, covering s.buf and
  s.inner.buf.
• analyzer.go:231 (LOW) — the goroutine-capture scan matched borrowed
  params by name, so a goroutine declaring its own b was reported as leaking
  the borrowed slice.

Index expressions and calls are deliberately still skipped: bufs[i] and
bufs[j] are written alike and need not be the same buffer, and a false
positive here blocks a build.

Verified against the unfixed analyzer

New fixtures fail on the old code exactly as intended — two missing diagnostics
and one unexpected:

escape.go:93: unexpected diagnostic: borrowed secret bytes handed to a goroutine
reentrancy.go:59: no diagnostic matching `Len called on the same buffer`
reentrancy.go:66: no diagnostic matching `IsSealed called on the same buffer`

With the fix: analyzer tests, go vet, golangci-lint, and the core +
secmem-crypto dogfood all clean.

This clears the last MEDIUM from the review; 18 rows remain, all LOW/INFO.