fix(security): avoid SKY-D212 RegExp literal false positives

[mcdigman]

What does this PR do?

Closes #803

Hi @duriantaco, I see you already self-assigned the new issue #803; however, I happen to already have a fix built for it, because this is one of the two remaining false positives when scanning skylos on liveness_primer itself. I think I made it before I had made any other PRs and I guess I forgot to PR it or actually open an issue before; feel free to close this if you don't want this solution/already wrote a better one.

Summary

• Determine if a javascript .exec call is actually a regular expression regardless of the name of the variable

Why?

SKY-D212 currently reports ordinary RegExp calls when the binding has an application-specific name:

explorer/src/lib/permalink.js:34 SKY-D212 child_process.exec() can lead to command injection

The old suppression was based on names such as regex and pattern, so it both missed this safe GITHUB_PATTERN.exec(url) call and could be evaded by assigning a dangerous receiver to a safe-looking name.

With this change, the same file produces no SKY-D212 finding while unsafe lookalikes remain reported.

Precision Impact

I think it strictly improves precision.

Checklist

• [x ] Tests pass (python3 -m pytest test/)
• [x ] No new false positives introduced (if modifying analysis logic)
• Added or updated a corpus case for any confirmed precision regression or false positive fix
• [x ] Ran the corpus guard (python3 scripts/corpus_ci.py --manifest corpus/manifest.json) if analysis logic changed