fix: resolve ReDoS vulnerability in safe_name regex (CodeQL rb/polynomial-redos)

[Copilot]

Fixes CodeQL alert #1: the -+\z sub-expression in safe_name allowed O(n²) backtracking on strings with many consecutive hyphens, enabling a denial-of-service via crafted input.

Summary

safe_name stripped leading/trailing hyphens using /\A-+|-+\z/. The -+\z branch is ambiguous — the engine retries the quantifier from every hyphen position before failing, giving quadratic worst-case time. Replaced both -+ branches with the possessive quantifier -++, which never gives back already-consumed characters:

# Before
.gsub(/\A-+|-+\z/, "")

# After
.gsub(/\A-++|-++\z/, "")

Possessive quantifiers are supported in Ruby's Oniguruma engine across all supported versions. Output is identical for all valid inputs.

Verification

• bundle exec rake test
• bundle exec rubocop
• Rule/schema/security tests added where applicable
• Documentation and changelog updated
• No credentials, production snapshots, or identifying paths included
• No network requests added to standard capture

Compatibility

Tested on Ruby 3.2.3 (x86_64-linux). Possessive quantifiers (++) are available in Oniguruma (used by MRI) since Ruby 1.9.