Only mark secrets removed from code after full scans

Only mark secrets removed from code after full scans

Since the secrets analyzer switched default branch pushes to commit-range scans, a report no longer lists every secret in the code. Secrets missing from such a report were flagged as removed from code and their location was redacted, even though they still exist. Only directory and historic scans now set the flag.

Related to #607808 (closed)