[PATCH] lib-sieve: Enforce CPU time limit within :contains and :matches matcher loops

[PATCH] lib-sieve: Enforce CPU time limit within :contains and :matches matcher loops

The naive O(N*M) substring search in mcht-contains.c and the naive find loop
in mcht-matches.c can run for hours on a large value (e.g. a message body),
completely bypassing sieve_max_cpu_time because that limit was only checked
between bytecode operations.

Expose the active CPU limit via sieve_runtime_cpu_limit_exceeded() and poll
it every 4096 inner iterations. When the limit is hit the match returns
SIEVE_EXEC_RESOURCE_LIMIT, matching the existing behavior at the bytecode
boundary. This is a minimal safety net ahead of switching the matchers to
algorithms that do not require it.

Gbp-Pq: Name CVE-2026-40016.patch