fix: code scanning alert 6 in Burp item extraction

[jbeckwith-oai]

Summary

• replace the whole-document item regex with an index-based item scanner
• add a regression test with repeated item-like noise plus multiple real items

Root Cause

CodeQL flagged the Burp item extraction regex as polynomial-time on crafted XML input because it scanned the entire export with a backtracking pattern.

Validation

• npm test -- src/parsers/burp-items.test.ts
• npm run build