fix: 存在潜在的 ReDoS 漏洞或低效正则表达式

[mmmsssttt404]

这个 PR 做了什么? (简要描述所做更改)
报告项目中潜在正则表达式拒绝服务 （ReDoS） 漏洞或低效的正则表达式。在上下文中使用特制的输入字符串时，可能会导致极高的 CPU 使用率、应用程序冻结或拒绝服务攻击。

taro/packages/css-to-react-native/src/index.js

Line 62 in d28acca

value = value.replace(/(\d+)px/g, '$1PX')

taro/packages/css-to-react-native/src/transforms/rem.js

Line 2 in d28acca

return value.replace(/(\d*\.?\d+)rem/g, (match, m1) => parseFloat(m1, 10) * 16 + 'px')

将正则改为

https://github.com/mmmsssttt404/taro/blob/196bc7a5b880890c3894c85c37977098bb75c5dd/packages/css-to-react-native/src/index.js#L62

https://github.com/mmmsssttt404/taro/blob/e41414ff8e402e8366bf3476fc658ce470bcd21b/packages/css-to-react-native/src/transforms/rem.js#L2

(?<!\d)(\d+)px

(?<!\d)((?:\d*\.\d+)|\d+)rem

改之前 测试指令后程序一直运行

改之后

步骤
1.git clone https://gitclone.com/github.com/mmmsssttt404/taro.git
2.cd tero
3.pnpm i
4.pnpm build
5.pnpm --filter taro-css-to-react-native test

这个 PR 是什么类型? (至少选择一个)

• 错误修复(Bugfix) issue: fix #
• 新功能(Feature)
• 代码重构(Refactor)
• TypeScript 类型定义修改(Typings)
• 文档修改(Docs)
• 代码风格更新(Code style update)
• 其他，请描述(Other, please describe):

这个 PR 涉及以下平台:

• 所有小程序
• 微信小程序
• 支付宝小程序
• 百度小程序
• 字节跳动小程序
• QQ 轻应用
• 京东小程序
• 快应用平台（QuickApp）
• Web 平台（H5）
• 移动端（React-Native）
• 鸿蒙（harmony）

Summary by CodeRabbit

• 测试
  • 新增了针对大数值 CSS 解析性能的测试，确保在极端情况下处理速度小于 1 秒。
• 修复
  • 优化了 px 和 rem 单位的正则表达式匹配，避免在长数字串中出现误匹配，提升了单位转换的准确性。

[coderabbitai]

## Walkthrough

本次更新主要针对 CSS 单位处理的正则表达式进行了增强，优化了 px 和 rem 单位的匹配逻辑，防止正则表达式被滥用导致性能问题（ReDos）。同时，新增了一个测试用例，用于验证 transform 函数在处理极大数值时的性能表现，确保其在 1 秒内完成处理。所有更改均未影响公共 API 的声明，仅涉及内部实现和测试。

## Changes

| 文件/路径                                                         | 变更摘要                                                         |
|-------------------------------------------------------------------|------------------------------------------------------------------|
| packages/css-to-react-native/src/index.js                         | 更新 px 单位的正则表达式，加入负向前瞻，防止误匹配和性能问题。    |
| packages/css-to-react-native/src/transforms/rem.js                | 更新 rem 单位的正则表达式，加入负向前瞻，增强匹配准确性。         |
| packages/css-to-react-native/__tests__/index.spec.js              | 新增 ReDos 测试套件，验证 transform 在极端输入下的性能。          |

## Sequence Diagram(s)

```mermaid
sequenceDiagram
    participant Test as ReDos Test
    participant Transform as transform()
    participant Regex as Regex Engine

    Test->>Transform: 传入超长数值的 CSS 字符串
    Transform->>Regex: 使用新正则处理 px/rem 单位
    Regex-->>Transform: 返回处理结果
    Transform-->>Test: 返回处理耗时

Poem

🐇
正则升级巧防御，
px、rem 皆分明。
巨数入测不慌乱，
秒内转换真轻盈。
代码如风守安全，
兔子鼓掌笑盈盈！

<!-- walkthrough_end -->


---

<details>
<summary>📜 Recent review details</summary>

**Configuration used: CodeRabbit UI**
**Review profile: CHILL**
**Plan: Pro**

<details>
<summary>📥 Commits</summary>

Reviewing files that changed from the base of the PR and between 91b1f575dc41ef4c864d831f4d427c99cdf27017 and da4db3760c98fb9c15ae1b6221731f368c8b6ad0.

</details>

<details>
<summary>📒 Files selected for processing (1)</summary>

* `packages/css-to-react-native/__tests__/index.spec.js` (1 hunks)

</details>

<details>
<summary>🚧 Files skipped from review as they are similar to previous changes (1)</summary>

* packages/css-to-react-native/__tests__/index.spec.js

</details>

</details>
<!-- internal state start -->


<!-- DwQgtGAEAqAWCWBnSTIEMB26CuAXA9mAOYCmGJATmriQCaQDG+Ats2bgFyQAOFk+AIwBWJBrngA3EsgEBPRvlqU0AgfFwA6NPEgQAfACgjoCEYDEZyAAUASpETZWaCrKNxU3bABsvkCiQBHbGlcSHFcLzpIACIAM3gADy5ADW1ACnVAHXtUwBC3SBsSABF8AGVIQHh7QDxbQDQjQDl5QAlTQGNrQEwlQAsIwD74wHh9aMg5SGxESkhWZkQR3DGAFgAGcfRaWn8R6R58GgxxNF88om9nSABRBN5pRHh8LHyyeA3+WMgiygl4BhJIAAo8wqKASkgJb3IqGovOp4Et8Hx4ORYvEGKC1n4SNsvLsSIcFiczshIWFYC9ePgRGINDBcSgRsEUBgJPgvFJkM8KLhtFh/KQEjxqDQKBgsVhcKSmEoBGh+jjqAAaSAAd1xWD6USl6lg9m4oiuPnkDCosRo9EhnlCiFwFEhREQkqY3noDDQ8sgqONJDYXnkCCIyoAwlYAKq9RBoUiStDcbjAm3iM6QWL+EgAL1NkvBkCUGHVN3sDyeL05aAYAGtEBojEVVbCYRsXZL+S9bINFPB4ktWaiOWNKDyo/hsBg9Xypfgo/BIshFfzsdXIAADBgjMAEMD+XO4MAYaiSEiTjn5gMkDhGKCTyFKBIaISITfUSDA8iQABsACYDAfjZhELFwcMAPT+Zin8/oUJrxeR8DDgF5wXgIhIWuZt2W4Tl2xHSgXn8UNcwVJU638e1oSeOFQjOJY+lNSByCINcpCvfB8DzAQSAQHt0EWRlTh5Pcn0gAAxJNmGoBgGKIHhEhIXwJA2YJEC4fjMFIegCCnV4AH5QAAHVoL5XjUgBqL5uASScOO4vheNwfiSJ/X5xOkKTYBkqJ5MnJTVPU14lI4NSACoVI0bSvgAH18n8DIMAAhEh32wid4gSSUKG7VMMEEmgjQUJwe3pW1+jk0l8SIKhmDCAdbMSyklHiVMaBdZMKXkidIXCmF8IRNliQAQR1AZg1DWQSKixIq1JZLcHpFhQxIGh7GwBhnhGWJvCq0dYC7UJURmk5KK9X0+h3ItQNJWtIQYLxsCUXkjTisRWOQeTUIoRQppeOryWzRipBNWJ5D6pIjAARmJD0vEInEUJIbh8BOAgXCjO6ConfFHiUegIrzIt72JAA5NBHnIibIVqnK7sJUJaHgfwxHBWQiwAZmJABJHkmR8ZNQbIFNYSIk4SsnbgMG4Ar4EnItxmJELsCHbK8UJ0RQkWqceb57oxa8WhBYMABWYkbG7MIQmQCLganJk7rAGdEDnQhFzEFcKI3Lc8x3P0SO53mCogeIvC5MJnEIU3zYXEgl2t8RKKG1W9tQaTEpeCPqERCDYyiEV0EVohovQRi0GhaXkArQZIXgMBcvynhkVwCLhkmkNwV1bpPoJglpd2ixIA9Fg2DWZAHCcFw3FJM4qqYVh2H4PkEGQTwmf8IIQjJaGWAN+U+CKU1IjAfJMAZSUZQHKeJJr/lLwnJg1hNAQ8HBSUhhGI0JmmSU0+vcQSqQBwlnHAVFBIDGBzmxlcT4EmiAGB9AxFgJMsQSB0GFPmaUSd4bwERsSMCqV26hFQAIE04V05I3wMArK9gaQiXkJGQULwjSyEiKlUMVwMDPElEeJ4a4SoH1CBOBwAhmDqBrpHUgyByD2QHGgWg/9HoDjhlLMQAByZAj9zLeCWHRCKLw2AUCgolXa+hjDgCgKzdMtp5ykABLHa0bd2BcF4PwYQ0t1wyE1J/QEahNDaF0GAQwJgoDuCxDnLA+jCCGOUNw0xawuBUClJNbu8geikIceoLQOhNFaNMAYeC25eGfl9vOS2y5VzBxIJ+AA+vkoaiBCmfiPKiDQiBSx/j3NEOpBhm6tVpsQMgASohd14lDfAtweHSCMK1UiJAwlDUmuoF4q42D0GiB8cGXQpRJyEYjQqBtDw9gqVU0Qf5NwjPdl/EkqAHBjIUGsZkOd7Ar0ejPG0ooWG/EoA2UE11SSThfDycum45q0IjFgG0WB8RrWTh6IoJRzokWPkyfOJU0B3KhsiVRLwxLHReK8H6kxJjijRZMSACc7p6xpIDKUUQejQuiNwaIPxFrYiBv0Y+tAkGDSuZiY0U1hqAuBX4eR0pMLQvxKqRk8hEUUn6KwsRY8rzOFIPYY0CZBgBwcAsA24g2BezzGQWuKzXlvg/B87sl1IzyX+ccFAMtML4G4N85Ak4gEbBUJELgsQNj9AvIxbmzh+gAFk6BXAAIrBEwZJKMjqNxBgzsxVltyJy0GwFQb5s9hxPMwJAVFaK84+CQKIM4tBCwkkuSlQ5E1HUDmFU8l4AApGeSqSDLWWcmrFnC000szddQR0026KFjjiDwlBy4b1zZoIw5hLCtQ9gEq6yzI2iDhWuTE6ZURg0ZFEJMngBBhntGsEEfSOLowHL05t9pDjV0XXwZdq72DqHkEoI6zhp0dkJdhXiSgADcI8qrQvIMMme+aXiy2hSM6536FlzCiO/Ptg5IhFjqdEfcSSUn2zSRki2AcrY5PXJ+RAFAGBlLWSeM8tT6mNOaf4mN7THCdOIT04qvDe4gyRCiNExxWJ+gEczGgYhsEIjQs8ISCQRKWSRcgV43N9IUtlCs61yIV22zNbG1ADqvCilsjISBcpuC0GMcsw6x0lDJzIjbKiNE6IMXoCKfoLFIyOWUiANSXxBb7PpJRl4ZB5VLFuf3eQ3BhKiSsnwlYKAh4k1jlVI4zwlnEuTJBdQ6B718VxMZxiqFkQheJCWNU5YNQDVA7SkEkZMASw44lp0w9YKUg1VQN5H4LhHX/J8vVWAMD4DCXaScn4nJWZcr5PSn5NyQiNAHeg3SpwtY6wkLr9LUALGlWIEtgwYu9SLUyHsGwgYeZ415/jkojhSHXSVeCLFrgmX4ksSlWBAZRz4BgRw9yGBSpNIlQsg7IDDq5DevdE6r0xrHQNudh7+vHuwCup4a7wiPKMNu8gEH6lPhg7mOD0h0mzkyUh7JNs0MYc/Jq8uiBvxOhqQYSDDSh2EdacR+gHTnDkcYA5xA1Hmo7D4HO9EjH5RyQHAgs9H0EQFW7OoXkBt9R4BuyReZyBmD1kbHSnN/ATRqJgoiFszXNK0C8hoRSgUnSfiIJuA7sX07yH6NPWh4Fbgkygqy6TrEKx2JOZCwS0LL3wF4r4MGeNOw+Aa0S+Q0QfzRHpS8bAqn1PFYV616zrlFLuSV95XyAVaA6S+D+DXF45hnN07k/TtF6JHgUpZ6z2yBxOejY9Uk2uogXeYHRCEPm0H+auJVdzZM6Ae/Tisf+4XTchvoHOsM6gqr9F27HZA9vHekUcBX7xvYaCkAoHi4ys31GS4S+hVBVEoLXZ/Kcg2/o2AWjOG9J+SVi8xaiBZQVojuMiVsYMbw4huokR6D9W87GuqsxIqShIPuB0E8eyOj7M78YvEvSnQtVnQPQXV+x4H+1PXXXEE3SgG3Upzsle1JBOCIByUL3TAnG+zAKjF1VjUnB/GgHwCsH0ghygyh0MAMHcTXX61uF8RaSMUCSHmCT8DQDCTJyhiiXsRUEcTiRcTcW0RQXUHyQQRKX8EeCGToHySNGcFCASSoJ+gAE5bwBAGAAB2NANWAQAADi0MmC0IUMmAYCpn0PGAYC0LViMNUIUNUNUMmAUK0NUFUIsLVjmD4MoIEIUJ+gEB+liDVicNoAYHGB+nClMK0NvHGFoC0Kph8IiPGHvFUIYAUIUIYFoFiHiMmB+lULcKoLUwiIECplUNvEMPsNiAEGSJ+jVjQBIC8IfHvEyOiNiCplvC0LMIEFvCESxTkIEMHk4VwGEKzXyTENBEJVoHyV0X0CAA -->

<!-- internal state end -->
<!-- finishing_touch_checkbox_start -->

<details open="true">
<summary>✨ Finishing Touches</summary>

- [ ] <!-- {"checkboxId": "7962f53c-55bc-4827-bfbf-6a18da830691"} --> 📝 Generate Docstrings

</details>

<!-- finishing_touch_checkbox_end -->
<!-- tips_start -->

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

<details>
<summary>❤️ Share</summary>

- [X](https://twitter.com/intent/tweet?text=I%20just%20used%20%40coderabbitai%20for%20my%20code%20review%2C%20and%20it%27s%20fantastic%21%20It%27s%20free%20for%20OSS%20and%20offers%20a%20free%20trial%20for%20the%20proprietary%20code.%20Check%20it%20out%3A&url=https%3A//coderabbit.ai)
- [Mastodon](https://mastodon.social/share?text=I%20just%20used%20%40coderabbitai%20for%20my%20code%20review%2C%20and%20it%27s%20fantastic%21%20It%27s%20free%20for%20OSS%20and%20offers%20a%20free%20trial%20for%20the%20proprietary%20code.%20Check%20it%20out%3A%20https%3A%2F%2Fcoderabbit.ai)
- [Reddit](https://www.reddit.com/submit?title=Great%20tool%20for%20code%20review%20-%20CodeRabbit&text=I%20just%20used%20CodeRabbit%20for%20my%20code%20review%2C%20and%20it%27s%20fantastic%21%20It%27s%20free%20for%20OSS%20and%20offers%20a%20free%20trial%20for%20proprietary%20code.%20Check%20it%20out%3A%20https%3A//coderabbit.ai)
- [LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fcoderabbit.ai&mini=true&title=Great%20tool%20for%20code%20review%20-%20CodeRabbit&summary=I%20just%20used%20CodeRabbit%20for%20my%20code%20review%2C%20and%20it%27s%20fantastic%21%20It%27s%20free%20for%20OSS%20and%20offers%20a%20free%20trial%20for%20proprietary%20code)

</details>

<details>
<summary>🪧 Tips</summary>

### Chat

There are 3 ways to chat with [CodeRabbit](https://coderabbit.ai?utm_source=oss&utm_medium=github&utm_campaign=NervJS/taro&utm_content=17619):

- Review comments: Directly reply to a review comment made by CodeRabbit. Example:
  - `I pushed a fix in commit <commit_id>, please review it.`
  - `Generate unit testing code for this file.`
  - `Open a follow-up GitHub issue for this discussion.`
- Files and specific lines of code (under the "Files changed" tab): Tag `@coderabbitai` in a new review comment at the desired location with your query. Examples:
  - `@coderabbitai generate unit testing code for this file.`
  -	`@coderabbitai modularize this function.`
- PR comments: Tag `@coderabbitai` in a new PR comment to ask questions about the PR branch. For the best results, please provide a very specific query, as very limited context is provided in this mode. Examples:
  - `@coderabbitai gather interesting stats about this repository and render them as a table. Additionally, render a pie chart showing the language distribution in the codebase.`
  - `@coderabbitai read src/utils.ts and generate unit testing code.`
  - `@coderabbitai read the files in the src/scheduler package and generate a class diagram using mermaid and a README in the markdown format.`
  - `@coderabbitai help me debug CodeRabbit configuration file.`

### Support

Need help? Create a ticket on our [support page](https://www.coderabbit.ai/contact-us/support) for assistance with any issues or questions.

Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments.

### CodeRabbit Commands (Invoked using PR comments)

- `@coderabbitai pause` to pause the reviews on a PR.
- `@coderabbitai resume` to resume the paused reviews.
- `@coderabbitai review` to trigger an incremental review. This is useful when automatic reviews are disabled for the repository.
- `@coderabbitai full review` to do a full review from scratch and review all the files again.
- `@coderabbitai summary` to regenerate the summary of the PR.
- `@coderabbitai generate docstrings` to [generate docstrings](https://docs.coderabbit.ai/finishing-touches/docstrings) for this PR.
- `@coderabbitai generate sequence diagram` to generate a sequence diagram of the changes in this PR.
- `@coderabbitai resolve` resolve all the CodeRabbit review comments.
- `@coderabbitai configuration` to show the current CodeRabbit configuration for the repository.
- `@coderabbitai help` to get help.

### Other keywords and placeholders

- Add `@coderabbitai ignore` anywhere in the PR description to prevent this PR from being reviewed.
- Add `@coderabbitai summary` to generate the high-level summary at a specific location in the PR description.
- Add `@coderabbitai` anywhere in the PR title to generate the title automatically.

### CodeRabbit Configuration File (`.coderabbit.yaml`)

- You can programmatically configure CodeRabbit by adding a `.coderabbit.yaml` file to the root of your repository.
- Please see the [configuration documentation](https://docs.coderabbit.ai/guides/configure-coderabbit) for more information.
- If your editor has YAML language server enabled, you can add the path at the top of this file to enable auto-completion and validation: `# yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json`

### Documentation and Community

- Visit our [Documentation](https://docs.coderabbit.ai) for detailed information on how to use CodeRabbit.
- Join our [Discord Community](http://discord.gg/coderabbit) to get help, request features, and share feedback.
- Follow us on [X/Twitter](https://twitter.com/coderabbitai) for updates and announcements.

</details>

<!-- tips_end -->

[Single-Dancer]

@mmmsssttt404 同学修复一下 lint 问题

[mmmsssttt404]

刚才已经进行修改，将多余的分号和空格删除了

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 58.37%. Comparing base (490770c) to head (da4db37).
Report is 1 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff            @@
##             main   #17619    +/-   ##
========================================
  Coverage   58.37%   58.37%            
========================================
  Files         469      469            
  Lines       27230    27230            
  Branches     5973     5953    -20     
========================================
  Hits        15895    15895            
- Misses       9810     9935   +125     
+ Partials     1525     1400   -125     

Flag	Coverage Δ
taro-cli	72.37% <ø> (ø)
taro-runtime	59.87% <ø> (ø)
taro-web	52.75% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

see 16 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.