Fix DS126858 false positive on --nomd5 and similar disable flags

[Copilot]

Rule DS126858 (Weak/Broken Hash Algorithm) was flagging cases where MD5 is explicitly disabled, e.g. makeself --sha256 --nomd5.

Changes

• Updated regex pattern to use negative lookbehind assertions that exclude MD5 when preceded by disable patterns:
  • \bno (matches nomd5, --nomd5)
  • \bno- (matches no-md5)
  • \bno_ (matches no_md5)
  • \bdisable_ (matches disable_md5_check)
• Added corresponding must-not-match test cases

Pattern

# Before
(MD2|MD4|MD5|RIPEMD|...)

# After  
(?<!\bno)(?<!\bno-)(?<!\bno_)(?<!\bdisable_)(MD2|MD4|MD5|RIPEMD|...)

The word boundaries ensure edge cases like xnomd5 are still flagged while legitimate disable flags are excluded.

Original prompt

---

This section details on the original issue you should resolve

<issue_title>[False Positive] DS126858 flagging --nomd5</issue_title>
<issue_description>## DS126858

What the rule matched

makeself --sha256 --nomd5

Why should this not be matched?

makeself uses md5 checksums as a basic verification mechanism, I am trying to change it to a sha256 checksum. From the makeself documentation:

--sha256 : Adds a SHA256 checksum for the archive. This is in addition to the MD5 / CRC checksums unless --nomd5 is also used.

https://github.com/megastep/makeself</issue_description>

<agent_instructions>Try to improve the md5 rule to be less broad. It seems like it probably shouldn't capture this 'nomd5' case.</agent_instructions>

Comments on the Issue (you are @copilot in this section)

@gfs Thanks for your report. I'll take another look at the md5 rule and see if I can narrow it down a bit.

• Fixes [False Positive] DS126858 flagging --nomd5 #612

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.