Split cookie names on both _ and - separators

splitTokens previously picked a single separator (_ winning over -).
Cookies like __Secure-1PSID were split on _ only, leaving
"Secure-1PSID" as one token that falsely passed looksVariable,
producing the bogus ___* heuristic pattern.

The function now splits by _ first, then sub-splits each non-UUID
part by -, tracking per-gap separators. heuristicTemplate trims
leading/trailing empty tokens before analysis so that prefix
underscores are preserved in the output but do not pollute the
variable detection.

Signed-off-by: Émile Ré <emile@probo.com>

pkg/cookiebanner/pattern_analysis_worker_test.go

@@ -233,6 +233,11 @@ func TestHeuristicTemplate(t *testing.T) {
 			template: "c15t-consent-*",
 			changed:  true,
 		},
+		{
+			name:    "leading underscores with dash not variable",
+			input:   "__Secure-1PSID",
+			changed: false,
+		},
 	}
 
 	for _, tt := range tests {
@@ -456,31 +461,43 @@ func TestSplitTokens(t *testing.T) {
 		name   string
 		input  string
 		tokens []string
-		sep    byte
+		seps   []byte
 	}{
 		{
 			name:   "underscore separator",
 			input:  "ph_phc_abc",
 			tokens: []string{"ph", "phc", "abc"},
-			sep:    '_',
+			seps:   []byte{'_', '_'},
 		},
 		{
 			name:   "dash separator",
 			input:  "c15t-consent-abc",
 			tokens: []string{"c15t", "consent", "abc"},
-			sep:    '-',
+			seps:   []byte{'-', '-'},
 		},
 		{
 			name:   "no separator",
 			input:  "PHPSESSID",
 			tokens: []string{"PHPSESSID"},
-			sep:    0,
+			seps:   nil,
 		},
 		{
-			name:   "underscore takes priority over dash",
+			name:   "mixed separators split both",
 			input:  "foo_bar-baz",
-			tokens: []string{"foo", "bar-baz"},
-			sep:    '_',
+			tokens: []string{"foo", "bar", "baz"},
+			seps:   []byte{'_', '-'},
+		},
+		{
+			name:   "leading underscores with dash",
+			input:  "__Secure-1PSID",
+			tokens: []string{"", "", "Secure", "1PSID"},
+			seps:   []byte{'_', '_', '-'},
+		},
+		{
+			name:   "UUID preserved as single token",
+			input:  "session_550e8400-e29b-41d4-a716-446655440000_data",
+			tokens: []string{"session", "550e8400-e29b-41d4-a716-446655440000", "data"},
+			seps:   []byte{'_', '_'},
 		},
 	}
 
@@ -489,9 +506,9 @@ func TestSplitTokens(t *testing.T) {
 			tt.name,
 			func(t *testing.T) {
 				t.Parallel()
-				tokens, sep := splitTokens(tt.input)
+				tokens, seps := splitTokens(tt.input)
 				assert.Equal(t, tt.tokens, tokens)
-				assert.Equal(t, tt.sep, sep)
+				assert.Equal(t, tt.seps, seps)
 			},
 		)
 	}
@@ -879,6 +896,21 @@ func TestFindMergeGroups(t *testing.T) {
 			assert.Len(t, statGroup, 3)
 		},
 	)
+
+	t.Run(
+		"secure prefix cookies do not produce heuristic glob",
+		func(t *testing.T) {
+			t.Parallel()
+
+			patterns := coredata.TrackerPatterns{
+				makePattern("__Secure-1PSID", &oneYear),
+				makePattern("__Secure-1PSIDTS", &oneYear),
+			}
+
+			groups := findMergeGroups(patterns, 3)
+			assert.Empty(t, groups)
+		},
+	)
 }
 
 func TestDurationBucket(t *testing.T) {