probe: token-length side-channel (#570)

[neerazz]

Implements #570 (probe: token-length side-channel).

What this adds

• garak/probes/side_channel.py — TokenLength probe. Elicits short, structured, sensitive-shaped answers whose length signature is the interesting part.
• garak/detectors/side_channel.py — TokenLengthLeak detector. Scores each output by the coefficient of variation of token-like output segment lengths, normalised to 0.0–1.0. A response with near-uniform token lengths scores low; a response with highly varied lengths scores high. This follows the observation from Weiss et al. 2024 ("What Was Your Prompt?", arXiv:2403.09751) and the Cloudflare write-up that the entropy of token-length sequences is what an eavesdropper can recover from encrypted packet sizes.
• Unit tests for probe and detector.
• Docs entries for the new probe/detector.

The probe ships active = False at INFORMATIONAL tier so it is available for targeted use without changing default probe behavior.

Implementation notes

• The detector is dependency-free and uses a tokenizer approximation because garak's generator interface receives completed text, not packet-size / streaming-token metadata.
• This keeps the first version narrow and mergeable. If maintainers prefer a generator-layer streaming/packet hook later, this probe can use that richer signal without changing the user-facing probe shape.
• Current tags: owasp:llm06, avid-effect:security:S0301, quality:Security:Confidentiality.

Verification

• Local focused tests: python3 -m pytest tests/detectors/test_detectors_side_channel.py tests/probes/test_probes_side_channel.py -q
• Result: 8 passed in 0.59s
• GitHub DCO: passing

[neerazz]

Ready for maintainer review.

I tightened the PR description so this is no longer framed as exploratory/draft. The branch is pushed and DCO is green. I also re-ran the focused local tests:

python3 -m pytest tests/detectors/test_detectors_side_channel.py tests/probes/test_probes_side_channel.py -q
# 8 passed in 0.59s

The only thing I can see blocking merge now is maintainer review / any repository-side CI that maintainers want to trigger on this fork PR.