Add bounded regex timeouts for extraction

[Widthdom]

Summary

• Added a bounded Regex wrapper for built-in extraction regexes so match operations use a finite timeout and fail closed on timeout.
• Switched built-in symbol and reference extractors to the bounded wrapper, including the Go reference regexes that previously used fully-qualified BCL Regex types.
• Added reflection/adversarial coverage plus changelog fragments for both issues.

Validation

• dotnet build CodeIndex.sln -p:UseSharedCompilation=false
• dotnet test tests/CodeIndex.Tests/CodeIndex.Tests.csproj -p:UseSharedCompilation=false --filter "FullyQualifiedName~SymbolExtractorTests.BuiltInSymbolRegexes_HaveBoundedMatchTimeouts|FullyQualifiedName~SymbolExtractorTests.Extract_BuiltInSymbolRegexes_AdversarialLongLinesDoNotThrow"
• dotnet test tests/CodeIndex.Tests/CodeIndex.Tests.csproj -p:UseSharedCompilation=false --filter "FullyQualifiedName~ReferenceExtractorTests.BuiltInReferenceRegexes_HaveBoundedMatchTimeouts|FullyQualifiedName~ReferenceExtractorTests.Extract_BuiltInReferenceRegexes_AdversarialLongLinesDoNotThrow"
• dotnet run --project tools/CodeIndex.Changelog -- check
• dotnet ./src/CodeIndex/bin/Debug/net8.0/cdidx.dll status --check --json
• dotnet test CodeIndex.sln -p:UseSharedCompilation=false
• Codex adversarial review: No blocking/actionable issues found.

Fixes #2876
Fixes #2887