fix(scan): use thread-safe pattern matching

[VibhorGautam]

what

the sidecar shares 1 Aho-Corasick matcher across concurrent requests, but Matcher.Match mutates an internal counter and trie nodes. concurrent calls can race and miss known matches

switches the scan stage to the library's thread-safe matcher and adds a 2,000-call synchronized regression test

impact

before the fix, repeated direct runs missed 217 to 341 of 2,000 matches. a live sidecar run at concurrency 4 also returned ALLOW for a payload that should SANITISE

after the fix, 8,000 live requests across concurrency 1, 4, 16 and 32 returned 0 wrong verdicts

testing

go test -race -count=1 ./internal/pipeline, 20 repeated pipeline runs, go vet ./..., the full Go suite and the uncached integration suite all pass