CVE-2026-58421: Gitea: Unauthenticated ReDoS via CODEOWNERS pattern matching allows denial of service

This issue has been found by a security agent and review by myself.

Gitea’s CODEOWNERS feature uses the regexp2 library to match file paths against ownership rules. User-supplied patterns are passed directly to regexp2.Compile with no sanitisation and no match timeout. This allows an attacker to write a pattern that causes the regex engine to backtrack exponentially when evaluated against a crafted file path.