harden api-key scheme regexes against polynomial backtracking

CodeQL flagged `^(ApiKey|Bearer)\s+(.+)$` as polynomial-ReDoS: `\s+` and
`.+` both match whitespace, so an all-whitespace tail backtracks O(n²).
Anchor the capture to a non-whitespace first char (`\s+(\S.*)`) — linear,
same behaviour for every valid header. Clears the pre-existing ApiKey alert
too.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: os-zhuang

packages/core/src/security/api-key.ts

@@ -84,10 +84,10 @@ export function extractApiKey(headers: any): string | undefined {
   if (x && x.trim()) return x.trim();
   const auth = readHeader(headers, 'authorization');
   if (!auth) return undefined;
-  const apiKeyScheme = auth.match(/^ApiKey\s+(.+)$/i);
+  const apiKeyScheme = auth.match(/^ApiKey\s+(\S.*)$/i);
   if (apiKeyScheme?.[1]?.trim()) return apiKeyScheme[1].trim();
   // Bearer is accepted only for prefixed api-keys (never for session tokens).
-  const bearer = auth.match(/^Bearer\s+(.+)$/i)?.[1]?.trim();
+  const bearer = auth.match(/^Bearer\s+(\S.*)$/i)?.[1]?.trim();
   if (bearer && bearer.startsWith(API_KEY_PREFIX)) return bearer;
   return undefined;
 }