GitHub CLI allows attestation verification bypass through unescaped regex metacharacters in github.com/cli/cli