Fix sanitizer stalls on long benign base64-like input

[cursor]

Bug and impact

Recent encoding-evasion hardening made scan_encoding_blocks() spend ~1.36s on a 20k-character benign non-hex alphabetic run and caused classify() to take ~9s on a 50k-character benign input. Because inspect() calls classify() in the core SCP path and the package allows inputs up to 2M characters by default, this could create practical CPU denial-of-service / user-facing hangs from non-malicious content.

Root cause

The base64 detector used a greedy lookahead regex ((?=[A-Za-z0-9+/]*[+/=])...) that backtracked heavily on long base64-character runs without +, /, or =. During the fix pass, padded alphanumeric base64 also needed explicit preservation because PowerShell-style -EncodedCommand ...= payloads do not necessarily contain + or /.

Fix

• Replaced the catastrophic base64 lookahead with the existing linear candidate regex plus explicit marker checks.
• Adjusted the candidate boundary so padded base64 ending in = is still detected.
• Reworked generic ROT-N matching to search encoded override regexes against the original text instead of decoding whole large candidate strings.
• Added regression coverage for long benign alphabetic runs, padded base64 detection, and avoiding full-input generic ROT-N decoding.

Validation

• PYTHONPATH=src python3 -m pytest tests/test_sanitize_encoding_evasion.py tests/test_security_regressions.py tests/test_appsec_host_allowlists.py -q -> 92 passed
• PYTHONPATH=src python3 -m pytest -q --ignore=tests/test_contract_document_hash.py -> 283 passed, 3 skipped
• Full PYTHONPATH=src python3 -m pytest -q still has the known baseline contract-hash failures in tests/test_contract_document_hash.py only (3 failed, 283 passed, 3 skipped).
• Timing probe: classify('g' * 50_000) now completes in ~0.17s; before the fix, a comparable 50k-character input took ~9s.