[#665] Fix StackOverflowError while parsing long ACI with repetitive targets

[vharseko]

Fixes #665

Problem

Aci.decode performs a quick syntax check via Pattern.matches(aciRegex, input). The targets part of that regex,

(\(\s*(\w+)\s*(!?=)\s*"([^"]+)"\s*\)\s*)*

repeats a group with an unbounded greedy quantifier. java.util.regex matches such repetition recursively — one stack frame per repetition — so an ACI value with hundreds of repeated target rules like (targetscope="&O")(targetscope="&O")... overflows the JVM stack with StackOverflowError instead of the expected AciException. Being an Error, it escapes catch(Exception) handlers on the aci-value validation paths (AciSyntaxImpl, AciHandler, AciList) and can kill the worker thread.

Fix

• AciTargets.targetRegex/targetsRegex: use possessive quantifiers (\s*+, \w++, (...)*+), as suggested in the issue, so the regex engine matches the repetition iteratively. Match results are unchanged (each possessive run is followed by a disjoint character class) and capture-group numbering is preserved.
• Same-shaped list regexes hardened: oidListRegex (Aci), attrListRegex (TargetAttr), rightsRegex (Permission). New constants WORD_GROUP_POSSESSIVE and ZERO_OR_MORE_WHITESPACE_POSSESSIVE; the shared greedy constants are left untouched (ATTR_NAME intentionally not modified — it is shared with TargAttrFilterList/ParentInheritance).
• Defense in depth: Aci.decode catches StackOverflowError and rethrows it as AciException, so a pathological ACI is treated as invalid instead of killing the thread (same approach as the GHSA-rv4q-c6mr-wxp7 fix).

Tests

New AciDecodeStackOverflowTestCase (runs decode on a bounded 256 KB stack thread so the pre-fix overflow is deterministic):

• 10 000 repeated (targetscope="&O") targets → rejected with AciException, no StackOverflowError;
• raw AciTargets.targetsRegex matches the same input iteratively (validates the regex fix independently of the defense-in-depth catch);
• a valid multi-target ACI still decodes successfully.

Verified: old regex overflows a 256 KB stack on the reproducer while the new one matches iteratively, with identical match results on a corpus of valid/invalid target strings. Adjacent ACI suites pass (AciBodyTest, TargetTestCase, TargetAttrTestCase, TargAttrFiltersTestCase, ExtOpTestCase, TargetControlTestCase, EnumRightTest — 134 tests, 0 failures).