[fix]: correct encoded SYSTEM XXE regex matching

The final branch of _XXE_INJECTION was missing % separators between
hex pairs. Pattern %(?:25)?53(?:25)?59... never matched because after
consuming %53 the next sub-pattern expected 5 or 2, not %. Fixed by
inserting % anchors between each pair so both single-encoded
(%53%59%53%54%45%4D) and double-encoded (%2553%2559...) SYSTEM strings
match correctly. All existing XXE branches are unaffected.

PROJECTS/advanced/ai-threat-detection/backend/app/core/features/patterns.py

@@ -112,7 +112,7 @@ _XXE_INJECTION = (
     r"xmlns\s*:\s*xi\s*=|"
     r"%(?:25)?3[Cc]!(?:ENTITY|DOCTYPE)|"
     r"&(?:xxe|xml|ext|file);|"
-    r"%(?:25)?(?:53|73)(?:25)?(?:59|79)(?:25)?(?:53|73)(?:25)?(?:54|74)(?:25)?(?:45|65)(?:25)?(?:4d|6d))")
+    r"%(?:25)?(?:53|73)%(?:25)?(?:59|79)%(?:25)?(?:53|73)%(?:25)?(?:54|74)%(?:25)?(?:45|65)%(?:25)?(?:4[Dd]))")
 
 _SSRF = (
     r"(?:169\.254\.169\.254|"