libclamav: report skipped PCRE evaluation through AlertExceedsMax

[AAH20]

Summary

Report Heuristics.Limits.Exceeded.PCREMaxFileSize through the existing
AlertExceedsMax mechanism when the PCRE matcher skips subsignature evaluation
because a file or buffer exceeds PCREMaxFileSize.

Closes #1785.

Root cause

Both PCRE size-limit branches return CL_EMAXSIZE. The generic scanner result
handler intentionally converts non-fatal max conditions to success so remaining
analysis can continue. Unlike MaxFileSize and MaxScanSize, the PCRE-specific
limit did not first append an exceeds-max heuristic or metadata record. A scan
could therefore report OK without an operational indication that PCRE
subsignatures were not evaluated.

Changes

• Report the limit through cli_append_potentially_unwanted_if_heur_exceedsmax
  for both fmap and buffer PCRE paths.
• Preserve existing behavior when AlertExceedsMax is disabled.
• Add regression coverage for alert enabled, alert disabled, and normal
  below-limit PCRE evaluation.
• Document that AlertExceedsMax covers PCREMaxFileSize and that exceeding it
  reduces detection coverage.

Validation

• Full native ClamAV debug build completed successfully on macOS arm64.
• python3 -m unittest -v clamscan.regex_test: 6 tests passed.
• New regression test confirms:
  • above limit + alert enabled: heuristic reported, exit 1;
  • above limit + alert disabled: compatibility behavior retained, exit 0;
  • below limit: PCRE signature evaluated and detected.
• git diff --check passed.

[val-ms]

I am open to this change, although I would ask that you not call out the PCRE limit in the documentation/config/help-string. We already have similar alerts for other limits, not just the size and time limits. You can find a short list in the older release notes: https://github.com/Cisco-Talos/clamav/blob/main/NEWS.md#01041 So if anything, those documentation/config/help-string messages should really be more general about alerts on exceeded limits overall because I wouldn't want to call out every possible limit in those places.

[AAH20]

Thanks @val-ms — good call. I've generalized all four doc/help-string/config-sample locations so they no longer single out PCREMaxFileSize (or any individual limit). The libclamav reporting itself is unchanged — it still emits Heuristics.Limits.Exceeded.PCREMaxFileSize through the existing AlertExceedsMax path, matching the pattern the other limit heuristics already use.

Happy to iterate further.