CPU-based Denial of Service in translation-finder via O(N²) per-result wildcard mask matching

- https://github.com/WeblateOrg/translation-finder - Affected version: **3.6.0** — commit `76186ba54f1e2c67176aa4c379c2f1d5fc406039` (HEAD at audit, 2026-10-05) - Tested on: Python 3.13.9, Linux x64, charset-normalizer 3.5.2

def mask_matches(self, mask: str) -> Generator[PurePath]:
    if "*" not in mask:
        match = self.files_by_path.get(mask)          # O(1) — not affected
        ...
    else:
        ...
        candidates = self.files_by_suffix.get(suffix, [])  # full bucket
    ...
    for name, path in …