fix: code scanning alert 5 in curl parser

[jbeckwith-oai]

Summary

• replace regex-based inline comment stripping with a small shell-aware scanner
• preserve # characters inside quoted or escaped curl arguments
• add parser regression tests for quoted, escaped, and comment cases

Root Cause

CodeQL flagged the greedy inline comment regex in parseCurl as polynomial-time on attacker-controlled input. It also stripped legitimate # characters from quoted headers and escaped data.

Validation

• npm test -- src/parsers/curl.test.ts
• npm run build