feat(snapshots): Add all_image_file_names_as_regex (new regex dep)

[NicoHinderling]

Adds an optional all_image_file_names_as_regex field to the snapshot upload endpoint. It works like the existing all_image_file_names, except each entry is a regex pattern (matched with fullmatch) rather than a literal file name. This lets callers declare the head build's complete image set with a handful of patterns instead of an exhaustive list — useful for selective uploads, where only changed images are sent but the full set is needed downstream to tell removed images apart from skipped ones.

The two fields are mutually exclusive and both require selective. Every uploaded image name must be covered by the declared set (appear in the list, or match at least one pattern), preserving the existing invariant. fullmatch (not search) is used because the literal field uses exact full-string equality, and full-match is its faithful regex analog.

Renames still work: rename detection runs after the removed/skipped partitioning by matching content hashes across added/removed/skipped, and that shared logic is unchanged.

New dependency: google-re2

Patterns are client-supplied, so they cannot be matched with a backtracking engine (stdlib re or the regex lib) without exposing a ReDoS vector — a pathological pattern can hang a worker. This PR matches them with RE2 (google-re2), a linear-time, finite-automaton engine:

• Catastrophic backtracking is impossible by construction — no time budget or timeout needed.
• Unsupported constructs (backreferences, lookaround) are rejected at compile time (re2.error), so the engine enforces the safe subset. These make no sense for filename patterns anyway.

Compiling a pattern is the validation (invalid/unsupported → 400), and the same compiled object does the matching. Pattern length (500 chars) and count (100) caps remain as sanity bounds. Reviewed with security; RE2's linear-time guarantee is the agreed approach over a wall-clock-timeout mitigation.

google-re2 was added to the internal PyPI mirror in getsentry/pypi#2192 (merged). It ships prebuilt wheels for all our targets and has no new transitive dependencies.

Refactor included

To avoid a third parallel code path, the literal and regex modes are unified behind a single SnapshotManifest.head_image_name_matcher() consumed by categorize_image_diff, and the endpoint's coverage checks are consolidated into one helper (make_image_name_matcher). Behavior-preserving. A root_validator on SnapshotManifest enforces the mutual-exclusion invariant at the model level.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit b630a47. Configure here.}