fix(invalid_regex): validate $N references in map values and across the whole scope; read $N as a single digit

[MegaManSec]

Previously only rewrite replacements and set-inside-if were checked, so a $1 against a captureless regex went undetected in map values, server_name/location regex contexts, return, proxy_pass, add_header, more_set_headers and try_files. Two new checks:

• map entries (exact): a map regex evaluation resets the request's numbered captures — verified against nginx at runtime — so $N in a regex entry's value can only come from that entry's own pattern.
• whole-scope (conservative): for other value-carrying directives, flag $N only when no regex that could run for the request — the enclosing server's location/if/rewrite/server_name patterns, plus any map regex key — defines group N, making the reference provably empty. Any unparseable provider pattern silences the check.

Also fix the reference tokenizer: nginx reads exactly one digit after $ (ngx_http_script_compile), so $12 is capture $1 followed by a literal 2; the old [1-9]\d* tokenizer reported $12 as a nonexistent group 12 (false positive).