validation: discount time spent building attack string

[davisjam]

Currently the timeout is applied on a process level. In some languages building a long query string is expensive and can lead to a timeout, although the regex match itself is fast.

A fix would be to have the callee indicate to the caller when it is beginning the regex match so that the caller can start a timeout then.

I do not think any of the languages currently supported in this repository have slow string building times, since they are all "scripting" languages that prioritize string operations. However, I have a work-in-progress C# version that does have this problem. At any rate, to avoid false positives the fix indicated above should be applied.