BREAKING CHANGE(core): limit regex to ReDoS safe patterns

[mttrbrts]

This PR changes the Regular Expression engine for String Validators to use re2-wasm. re2-wasm is a drop-in replacement that prohibits back-tracking. This protects us from Regular Expression Denial of Service (ReDoS) attacks on the server. Client-side code should directly validate user-provided regexes if they are being evaluated client-side.

Changes

• Changes the implementation of the RegExp engine in StringValidator in concerto-core
• Fixes a vulnerable regex in the metamodel! 😱
• Refactors use of backtracking in the property name regex in the metamodel to the core runtime instead.
• Improves the error message for Validator failures.
• Fixes a bug with incorrect pattern code generation for JSON Schema targets.

Flags

• This is a breaking change because existing models with regex string validators that use backreferences or lookahead assertions are no longer supported.
• re2-wasm also uses Unicode mode by default.
• re2-wasm is not supported in the browser, so we fallback to RegExp (i.e. the previous behaviour).
• Added unrelated test to keep code-coverage above 98% threshold, due to unrelated change.

Author Checklist

• Ensure you provide a DCO sign-off for your commits using the --signoff option of git commit.
• Vital features and changes captured in unit and/or integration tests
• Commits messages follow AP format
• Extend the documentation, if necessary
• Merging to master from fork:branchname

[dselman]

One question about the JSON Schema regex - but otherwise looks good.