Security: ReDoS in ParametersUtils parameter substitution (CodeQL alert #6)

CodeQL alert #6 · rule java/polynomial-redos · severity high File: `core/src/main/java/com/netflix/conductor/core/utils/ParametersUtils.java`

Sub-issue of #1010.

Problem

`PATTERN` (defined at ParametersUtils.java:56) is a complex regex with nested quantifiers that is applied to every string-valued task parameter during workflow execution (PATTERN.matcher(paramString) at line 258).

Task output from an external worker flows into the next task's input parameters, so a crafted string returned by a worker can drive the matcher into O(n²)-to-exponential backtracking. This is reachable in externally-facing deployments — the highest real-world risk item in the epic after the SSRF.

Fix direction

Replace the backtracking-prone PATTERN with a linear/iterative parser (or a bounded, backtracking-free regex) for ${...} expression extraction. Preserve existing substitution semantics; add unit tests with adversarial inputs that would currently blow up.