Merge branch 'nindurkar/raise-regex-match-timeout-50ms' into 'master'

      # unbounded elsewhere), and a timeout reaches Evaluator's fail-open

      # rescue, so the request goes unlimited.

      #

      # 5ms is ~119x the slowest real match measured against GitLab's

      # RackAttack path patterns on inputs up to 16KB (worst: 0.0419ms, none

      # timed out). Re-measure if a rule ever needs nested quantifiers or

      # backreferences, which are what make backtracking exponential.

      MATCH_TIMEOUT_SECONDS = 0.005

      # 50ms is a safety net against catastrophic backtracking, not a

      # performance bound: real matches are far cheaper (median 0.087ms, worst

      # 1.484ms across 6935 paths that timed out in production at 5ms). Those

      # timeouts were wall-clock stalls, since Ruby counts real time and GC

      # pauses on GitLab's git fleet have a p50 of ~72ms. Under 4x CPU

      # oversubscription 50ms still fires on 0.16% of those matches, 5ms 1.33%.

      MATCH_TIMEOUT_SECONDS = 0.05

      def self.build(input)

        case input