fix(security): use bare nosemgrep for the glob-matcher RegExp (CI rule-id resolution)

The rule-id-scoped `// nosemgrep` added in #14 suppressed the
detect-non-literal-regexp finding locally — verified with the exact CI toolchain
(Semgrep 1.164.0, `semgrep scan --config auto --sarif`) producing an empty
SARIF — but CI's auto-resolved rule id apparently differs, so code-scanning
alert #47 reopened on the same line. A bare `// nosemgrep` does not depend on
rule-id matching and is robust to that resolution.

Verified: a full-repo scan with the identical CI command yields 0 results.
167/167 - lint clean - typecheck 0.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: dev-ecd-dm

csreview/src/ignore.js

@@ -103,7 +103,9 @@ export function patternToMatcher(rawPattern) {
   // user's own .csreview-ignore or built-in defaults (a local dev tool), and the
   // behaviour is unit-tested (ignore.test.js "ReDoS H1"). The dynamic RegExp is
   // intrinsic to a glob matcher, so this audit finding is suppressed inline.
-  return { negate, re: new RegExp(prefix + body + suffix) }; // nosemgrep: javascript.lang.security.audit.detect-non-literal-regexp.detect-non-literal-regexp
+  // Bare nosemgrep (not rule-id-scoped) so the suppression is robust to how the
+  // CI's `--config auto` resolves the rule's internal id.
+  return { negate, re: new RegExp(prefix + body + suffix) }; // nosemgrep
 }
 
 /**