Add timeouts or non-backtracking to reference extraction regexes

[Widthdom]

Finding

Reference extraction contains many compiled regular expressions that run over source lines and language-specific type/reference expressions without explicit match timeouts or non-backtracking. This is separate from the already filed built-in symbol extraction regex issue.

Evidence

• src/CodeIndex/Indexer/References/Support/LanguageReferenceExtractionSupport.cs defines many RegexOptions.Compiled | RegexOptions.CultureInvariant patterns.
• src/CodeIndex/Indexer/References/Languages/PythonReferenceExtractor.cs:152 uses Regex.Replace without a timeout.
• src/CodeIndex/Indexer/References/ReferenceExtractor.TypeReferences.cs:2558 calls regex.Replace(...) on prepared input.

Suggested fix

Audit reference extraction regexes, add bounded match timeouts or RegexOptions.NonBacktracking where compatible, and add adversarial long-line tests for representative languages.

[Widthdom]

Work started on branch fix-issue2876-2887.