atlassian_confluence: bound the Cloud group-name split in Painless - #21671

atlassian_confluence: bound the Cloud group-name split in Painless

The ECS user fields script splits Cloud audit group names rendered as
'<groupName>:<groupId>' using an unanchored greedy regex,
(.+):(<uuid>)$. When atlassian_cloud is enabled and a group name does
not match that format, matcher.find() backtracks across the whole name
and can exceed the Painless regex limit. A 68-character name observed
in customer data ('<groupId>; User: <accountId>' for a membership
event) fails with "Regular expression considered too many characters"
(limit factor 6, 409 of 408 characters considered), turning the whole
document into a pipeline_error.

Replace the regex with string operations: find the last ':', check
that a 36-character suffix follows, and validate that suffix with an
anchored full-match UUID pattern. The regex now only ever runs against
a fixed 36-character substring, so the work is bounded regardless of
group-name length. Also guard against a null group name, which
previously raised a NullPointerException from matcher().

Splitting behaviour for '<groupName>:<groupId>' names is unchanged;
the regenerated cloud expected file only gains the new document. Add
the offending event to test-audit-cloud.log to cover the fix on the
configured Cloud path.