Add secret to PRESIGNED_UPLOAD_SCAN_TYPES and give it the 5GB presigned zip-size limit so async secret scans upload as a single file directly to object storage (BYOS-aware), mirroring SAST. Gate the presigned single-file path on non-sync flow so a --sync secret scan keeps its bounded batched inline upload.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Switching secret scans to the presigned upload path routed them through
get_upload_link -> S3 -> scan_repository_from_upload_id, none of which
were registered by mock_scan_async_responses. The scan hit an unmocked
endpoint, returned 0 violations, and failed test_passing_output_option.

- Extend mock_scan_async_responses to register the presigned endpoints
  (upload-link, S3 POST, repository) for presigned scan types, branching
  on should_use_presigned_upload.
- Widen the presigned-upload fallback in _perform_scan to also catch the
  client's wrapped RequestError/SlowUploadConnectionError, not just raw
  requests.RequestException. A connection/timeout error from get_upload_link
  or the scan trigger otherwise never fell back to the Cycode-API upload.
- Add a regression test covering the wrapped-exception fallback.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>