Harden scanner: cap Aho-Corasick match reporting to prevent output link traversal blowup

[derekxmartin]

Problem

The DeepPrefixChain adversarial test revealed that Aho-Corasick output link traversal is O(n × max_pattern_len) in the worst case. For example, 500 nested "a" patterns against 1000 'a's produces 375,250 matches. A crafted input could exploit this to stall the scan pipeline.

Context

Discovered during P1-T4 adversarial testing. The behavior is inherent to Aho-Corasick (not a bug), but a production scanner should bound the cost.

Proposed mitigations

• Add a configurable max_matches_per_scan cap to akav_ac_search — stop early once the limit is hit
• Add a per-file scan timeout check inside the search loop (integrate with akav_scan_options_t.timeout_ms)
• Consider limiting output link chain depth during finalize (cap the number of suffix matches reported per position)
• Evaluate sparse transition representation to reduce memory footprint for large pattern sets (64KB pattern = 68MB serialized)

Phase

Address during Phase 11 (Hardening) or as part of P1-T8 (scan pipeline integration).

Related

• P1-T4 PR: P1-T4: Aho-Corasick multi-pattern byte matcher #4
• Test: AhoCorasickTest.DeepPrefixChain
• REQUIREMENTS.md §3.3 (pipeline error model)