Service stall via quadratic selector trimming

Regular expression denial of service in Soup Sieve before 2.9 allows remote attackers to stall services through crafted CSS selectors. In selector_iter, the unanchored RE_WS_END.search operation retries greedy whitespace or comment matching at every offset, causing quadratic CPU work. Exploitation requires an application to pass attacker-controlled selectors to compile or select; hard-coded selectors are unaffected, and the consequence is CPU exhaustion that can hold the GIL and stall workers without memory corruption or code execution.