fix(xinclude-injection): reduce false positives with stricter regex

The previous regex 'root:.*?:[0-9]*:[0-9]*:' was too permissive and matched
content in minified JavaScript code, causing false positives.

Changed to 'root:[^:]*:\d+:\d+:' which:
- Uses [^:]* to only match non-colon characters (respects passwd delimiter)
- Uses \d+ to require at least one digit for UID/GID

Fixes #14775

dast/vulnerabilities/injection/xinclude-injection.yaml

@@ -35,11 +35,10 @@ http:
         name: linux
         part: body
         regex:
-          - 'root:.*?:[0-9]*:[0-9]*:'
+          - 'root:[^:]*:\d+:\d+:'
 
       - type: word
         name: windows
         part: body
         words:
           - 'for 16-bit app support'
-# digest: 4a0a00473045022100e69db58569b4f4e5f60abf7e90300e73b9999127ef3b07cc6e90798e22187bdd0220062843c2ed9f731d9b4985e0b587e5f3e8ac58c29aa83a84f18d21ca4dcda0e4:922c64590222798bb761d5b6d8e72950