Allow CLI flags to override config file settings with empty values

[toller892]

Problem

When a user passes --encrypted-regex='' on the command line, the intent is to unset the config file's encrypted_regex setting. Previously, the code checked if the CLI value was empty string and fell back to the config file value, making it impossible to override config settings with empty strings.

This affects all six suffix/regex flags: --encrypted-suffix, --unencrypted-suffix, --encrypted-regex, --unencrypted-regex, --encrypted-comment-regex, --unencrypted-comment-regex.

Fixes #617

Root Cause

In getEncryptConfig() (cmd/sops/main.go), the precedence logic was:

if encryptedRegex == "" {
    encryptedRegex = optionalConfig.EncryptedRegex
}

This treats "flag not provided" and "flag explicitly set to empty" identically.

Fix

Use cli.Context.IsSet() to distinguish between "flag not provided" (use config) and "flag explicitly set to empty string" (use CLI value):

if !c.IsSet("encrypted-regex") && encryptedRegex == "" {
    encryptedRegex = optionalConfig.EncryptedRegex
}

This pattern is already used elsewhere in the codebase (c.GlobalIsSet("indent") at line 2391).

Testing

• go build ./cmd/sops/ passes
• go test ./config/ passes
• go test ./... -short passes (only pre-existing PGP keyring test fails, unrelated to this change)