fix: add ReDoS protection for excludedNamespaces regex validation

- Limit regex length to 512 characters to mitigate catastrophic
  backtracking (ReDoS) attacks via overly complex patterns
- Improve error message to include the actual regexp compilation error
  for better debugging

Author: enriqueavindi

api/v1alphav1/webhook_validations.go

@@ -70,9 +70,14 @@ func isClassDefault(class OvercommitClass, client client.Client) error {
 }
 
 func checkIsRegexValid(regex string) error {
+	// Limit regex length to prevent ReDoS (catastrophic backtracking)
+	const maxRegexLen = 512
+	if len(regex) > maxRegexLen {
+		return fmt.Errorf("regex is too long (%d chars), maximum allowed is %d", len(regex), maxRegexLen)
+	}
 	_, err := regexp.Compile(regex)
 	if err != nil {
-		return errors.New("Error: the regex is not valid")
+		return fmt.Errorf("invalid regex for excludedNamespaces: %w", err)
 	}
 	return nil
 }