fix(security): propagate quantifier state to parent groups in ReDoS detection

- Propagate hadQuantifier to parent depth when closing groups
- Fixes detection of deeply nested patterns like ((a+))+ and (((x+))+)+
- Inner groups with quantifiers now properly marked at parent level

src/utils/arrayParser.ts

@@ -45,6 +45,9 @@ function isUnsafePattern(pattern: string): boolean {
         if (hadQuantifier) return true; // nested quantifier!
         // Mark parent depth as having a quantifier
         quantifierAtDepth[depth] = true;
+      } else if (hadQuantifier) {
+        // Group contained quantifier but isn't followed by one - propagate to parent
+        quantifierAtDepth[depth] = true;
       }
     } else if ((ch === '+' || ch === '*') && depth > 0) {
       quantifierAtDepth[depth] = true;