Fix code scanning alert - Polynomial regular expression used on uncontrolled data

Pain

Code scanning flagged a quadratic slash-trimming regex in the GraphQL media helpers, and that regex is still on main.

Nothing uncontrolled reaches the regex: both callers pass the project's own mediaRoot config value.

A maintainer dismissed the alert as "won't fix" an hour after this issue was raised. So the next person to open this sees a dismissed alert and the word "Fix", and either closes it or redoes the investigation. A sibling tracking issue was closed citing a PR that never touched this file, so that fix did not reach here.

️ Approach

• Decide whether the team is overriding the "won't fix" dismissal
• If overriding, replace the regex with a linear trim and cover it with a unit test

✅ Acceptance Criteria

• The dismissal is either upheld, and this issue closed saying why, or explicitly overturned
• If overturned, leading and trailing slashes are still trimmed, with no quadratic backtracking, and a test proves it

Related

• https://github.com/tinacms/tinacms/security/code-scanning/29
• https://github.com/tinacms/tinacms/issues/5529