fix(security): Resolve SonarQube security hotspots

Introduce a default regex match timeout across the library to prevent potential ReDoS attacks (SonarQube rule S6444).
Implement `[OnDeserialized]` methods to re-establish object invariants and validate state after deserialization, addressing SonarQube rule S5766.

src/Strata.SqlTools.Snowflake/Breakdowns/UpdateBreakdown.cs

@@ -1,4 +1,5 @@
 using System.Collections;
+using System.Runtime.Serialization;
 using System.Text;
 using SqlServerUpdateBreakdown = Strata.SqlTools.Breakdowns.SqlServer.UpdateBreakdown;
 using StatementParser = Strata.SqlTools.Statements.Snowflake.StatementParser;
@@ -45,6 +46,14 @@ public class UpdateBreakdown : SqlServerUpdateBreakdown
         WhereClause.Comment = whereComments.Count > 0 ? string.Join(" ", whereComments) : null;
     }
 
+    /// <summary>
+    /// Re-establishes invariants after deserialization, since deserialization bypasses the
+    /// constructors that normally initialize the breakdown's clause state (SonarQube rule S5766).
+    /// </summary>
+    /// <param name="context">The streaming context for the deserialization operation.</param>
+    [OnDeserialized]
+    private void OnDeserialized(StreamingContext context) => RevalidateBreakdownState();
+
     /// <summary>
     /// Gets the SQL breakdown as a string for Snowflake.
     /// </summary>
@@ -160,7 +169,7 @@ public class UpdateBreakdown : SqlServerUpdateBreakdown
             // Check if it's an UPDATE statement
             var sqlTrimmed = sql.TrimStart();
             if (!System.Text.RegularExpressions.Regex.IsMatch(sqlTrimmed, @"^\s*UPDATE\b",
-                System.Text.RegularExpressions.RegexOptions.IgnoreCase))
+                System.Text.RegularExpressions.RegexOptions.IgnoreCase, Strata.SqlTools.SqlBreakdown.Utilities.RegexDefaults.MatchTimeout))
             {
                 errorMessage = "SQL statement must start with UPDATE.";
                 return false;
@@ -176,7 +185,7 @@ public class UpdateBreakdown : SqlServerUpdateBreakdown
             // Parse UPDATE statement - handle both with and without FROM clause
             var updateMatch = System.Text.RegularExpressions.Regex.Match(sql,
                 @"UPDATE\s+([^\s]+)\s+SET\s+(.*?)(?:\s+FROM\s+(.*?))?(?:\s+WHERE\s+(.*))?$",
-                System.Text.RegularExpressions.RegexOptions.IgnoreCase | System.Text.RegularExpressions.RegexOptions.Singleline);
+                System.Text.RegularExpressions.RegexOptions.IgnoreCase | System.Text.RegularExpressions.RegexOptions.Singleline, Strata.SqlTools.SqlBreakdown.Utilities.RegexDefaults.MatchTimeout);
 
             if (!updateMatch.Success)
             {