fix(rules): widen CORS regex for framework patterns and fix negation filter edge cases

[ajianaz]

What

Rewrites the CORS wildcard regex to cover 10 framework-specific patterns that were missed after PR #484, and fixes three edge cases in the negation filter and env-var suppression that caused false negatives.

Why

PR #484 narrowed the CORS regex to fix false positives (#483), but the narrowing was too aggressive: 13 of 14 common framework-specific CORS wildcard patterns were no longer detected. The negation filter also suppressed real findings on mixed comment/code lines, and the cors_config suppression caught bare assignments instead of only env-var reads. Additionally, is_doc_file() treated extensionless filenames like org or tex as documentation.

Closes #488, closes #489.

How

security_scanner.rs:

• Rewrote CORS regex using (?ix) extended mode with 10 alternatives covering HTTP headers, generic assignments, Django, Spring Boot, .NET, tower-http, Express, FastAPI, nginx, and actix-web
• Removed unsupported lookahead (?!\w) (Rust regex crate limitation) — replaced with explicit trailing delimiters
• Fixed is_doc_file() to check for dot before extracting extension

builtin.rs:

• Negation filter now skips suppression when comment body contains code indicators (=, fn , let , const )
• cors_config suppression scoped to env::var()/getenv()/os.environ read patterns only
• Pre-compiled negation regexes with LazyLock<Vec<Regex>>

Testing

• cargo test --features tree-sitter passes — 836 tests, 0 failures (15 new tests added)
• cargo fmt --all -- --check passes
• cargo clippy --all-targets --features tree-sitter -- -D warnings passes
• cargo build --release --features tree-sitter passes
• Manual smoke-test: verified regex against 12 framework patterns and 3 false-positive cases in isolation before integrating

New test coverage:

• 8 framework pattern tests (nginx, Django, Spring, .NET, tower-http, Express, FastAPI, actix)
• 3 negation/env-var edge case tests (mixed comment+code, bare assignment, env var read)
• 1 is_doc_file extensionless file test

Related Issues

Closes #488, closes #489

Checklist

• Branch name follows convention (fix/)
• Branch is from develop
• Commit messages follow Conventional Commits
• No secrets or credentials committed
• One logical change per PR (CORS scanner fixes from CORS scanner over-correction: regex misses 13/14 common framework patterns + negation filter false negatives #488 + is_doc_file() incorrectly treats extensionless files as documentation #489)