Compile member-selectors once instead of per resolution

[ndreno]

(Supersedes #2, which GitHub auto-closed when its stacked base branch #1 was deleted on merge. Same commit, now rebased onto main.)

The lever

A regex member-selector (REQUEST_HEADERS:/^X-/, !REQUEST_COOKIES:/__utm/) was kept as a string and recompiled with the regex crate on every value it was tested against, on every request. CRS carries 162 rules with a !REQUEST_COOKIES:/__utm/ or /_pk_ref/ exclusion, and the exclusion closure recompiles the selector once per resolved cookie, per rule, per request.

Measured in isolation:

cookies= 1   selector evals=  162   recompile-each= 1.359 ms   cached= 0.004 ms   saved 99.7%
cookies= 5   selector evals=  810   recompile-each= 3.251 ms   cached= 0.014 ms   saved 99.6%
cookies=20   selector evals= 3240   recompile-each=12.519 ms   cached= 0.061 ms   saved 99.5%

Against the ~2 ms the gateway measures for a whole inspection, this was the dominant cost, hiding in the exclusion path.

The change

Compilation turns each parsed Target into a CompiledTarget whose regex selector is a compiled regex::Regex, built once. Resolution matches the compiled form directly and rebuilds nothing (grep confirms no regex::Regex::new remains in the resolve path, was 2).

The parsed Target/Selector in the AST are untouched, so the sealed rule-set format is unchanged — only the in-memory compiled program gains CompiledTarget/CompiledSelector. This also subsumes the selector validation merged in #1: compiling the selector is what validates it, so check_targets became compile_targets, and an uncompilable selector still fails the build with the same InvalidSelector error.

Verification

• 169 unit tests pass; clippy and fmt clean.
• Real CRS 4.9.0 still compiles to 590 rules, same 4 detectSQLi/detectXSS refusals, zero unexpected errors.
• Exclusion semantics preserved: a request carrying __utmz=attack is allowed by a rule that session=attack trips.
• Both fail-closed behaviors from Refuse invalid selectors and backward skipAfter at compile time #1 survive.
• CI (including the FTW regression job) green on this commit.