test(secrets): cover ReferencedBy dedup within one connection and case-insensitive bootstrap exclusion

tests/ZB.MOM.WW.ScadaBridge.Commons.Tests/Types/Secrets/SecretReferenceScannerTests.cs

@@ -30,6 +30,20 @@ public class SecretReferenceScannerTests
     [InlineData("""{"Port":5000}""")]
     [InlineData("not json")]
     [InlineData("""{"Psk":"secret:SB-GRPC-PSK-site-a"}""")]
+    [InlineData("""{"Psk":"secret:sb-grpc-psk-site-a"}""")]
     public void IgnoresNonReferences(string json)
         => Assert.Empty(SecretReferenceScanner.Scan([Dc("C", json)]));
+
+    [Fact]
+    public void ReferencedBy_DeduplicatesWhenOneConnectionRefsTheSameSecretMultipleTimes()
+    {
+        var refs = SecretReferenceScanner.Scan([
+            Dc(
+                "GW1",
+                """{"a":"secret:mxgw-key","b":["secret:mxgw-key","secret:mxgw-key"]}""",
+                """{"ApiKey":"secret:mxgw-key"}"""),
+        ]);
+        Assert.Equal(["mxgw-key"], refs.Select(r => r.Name));
+        Assert.Equal(["GW1"], refs.Single(r => r.Name == "mxgw-key").ReferencedBy);
+    }
 }