fix(regex): bound regex matching to prevent ReDoS

[feiiiiii5]

Root Cause

RegexDetectionOptions.compile_patterns pre-compiles configured patterns with the stdlib backtracking re engine, and detect_regex_pattern evaluates them with compiled.search(text) — no time limit, no input bound. A pathological configured pattern (e.g. nested quantifiers) combined with crafted input, model output, or retrieval text can cause catastrophic backtracking and pin a worker indefinitely (ReDoS).

Fix

• Compile patterns with the timeout-capable regex module (already an existing transitive dependency; now declared directly in pyproject.toml).
• Bound each match with REGEX_MATCH_TIMEOUT_SECONDS = 0.5 (nemoguardrails/library/regex/actions.py).
• Fail closed on timeout: if a configured pattern cannot be evaluated within the budget, the text is treated as matching (blocked) and a warning is logged — forbidden content cannot slip through because the matcher was too slow.
• Preserve case_insensitive behavior and invalid-pattern error reporting at config load (regex.error and re.error are both caught and surfaced as the existing ValueError).

Test

• test_regex_action_bounds_catastrophic_backtracking: the pathological pattern (a|aa)+$ against "a"*40 + "b" returns a blocked outcome within 2s instead of hanging (previously effectively unbounded under re).
• test_regex_action_valid_pattern_still_matches_with_timeout: ordinary case-insensitive patterns still match within the budget.
• Existing suite tests/test_regex_detection.py: 18 passed (including invalid-pattern-at-config-load, case-insensitive, multiple-pattern, input/output/retrieval flows).
• ruff==0.14.6 check + format clean on changed files.

Diff scope

4 files, +87/-6: nemoguardrails/library/regex/rail_config.py, nemoguardrails/library/regex/actions.py, tests/test_regex_detection.py, pyproject.toml.

AI Disclosure

AI-assisted implementation and tests; human review of the fail-closed semantics, the regex-module compatibility (superset of re, error-type handling), timeout budget, and final diff before submission.

Closes #2203

[feiiiiii5]

@Pouyanpi gentle ping for review when you have a chance. This bounds regex matching to fail closed on catastrophic-backtracking timeouts, with regression tests; CI is green. Happy to adjust anything.