* fix(media-embed): remove ReDoS-prone regexes in host-gated providers
Replace the unbounded '.*' patterns flagged by CodeQL (js/polynomial-redos) in
the YouTube, Facebook, and Giphy branches with bounded extraction off the parsed
URL (pathname / searchParams). Eliminates the O(n^2) backtracking a crafted
valid-host URL could trigger, with no change to matched links.
* test(media-embed): lock youtu.be trailing-slash + edge parity
Use the first path segment for youtu.be ids so a trailing slash still resolves
(matching the previous regex), and cover extra-query-param, si-param, embed-query,
and short-id cases.
* fix(media-embed): dispatch YouTube id by path shape; drop inline comments
- Resolve id from the /embed/ path segment before the ?v= query param so a valid
embed URL with a spurious v param still embeds (was returning null)
- Remove non-TSDoc inline comments from the module and its test
Waleed
48752c6024