Suspicious regex: field-context heuristics

[jonasbb]

https://github.com/doctena-org/octorules-cloudflare/blob/ac57450/docs/lint/stage2-per-rule.md#cf543--substring-index-out-of-bounds-or-inverted

Fields in scope:

Hostname / URI fields: http.host, http.referer, http.request.uri, http.request.uri.path, http.request.full_uri, cf.worker.upstream_zone, plus the raw.* request-URI variants.
X.509 Distinguished Name fields (the CN= portion is hostname-style; OIDs need the same escaping): cf.tls_client_auth.cert_subject_dn, cert_subject_dn_legacy, cert_subject_dn_rfc2253, cert_issuer_dn, cert_issuer_dn_legacy, cert_issuer_dn_rfc2253.