Update go modules - #327

…#330)

* fix(highlight): raise regexp2 backtracking cap so long tokens keep their color

regexp2 v2.7.1 added a default MaxBacktrackingStackSize of 100000 that did not
exist in v2.2.1. Chroma compiles every lexer rule with a bare regexp2.Compile
and its matchRules drops results whose match returned an error, so a rule that
trips the cap degrades to a non-match with nothing logged. A Go string literal
over roughly 17k characters was repainted as chroma.Error, and revdiff could
not see it because highlightFile only checks the error Tokenise itself returns.

Raise the package default from New(), which is the only route into chroma's
deferred rule compilation. The cap stays finite rather than going back to
unbounded: revdiff opens arbitrary repos and 2.7.1 added the bound for a
reason. Multi-megabyte tokens still exceed it, and the comment says so.

regexp2 moves from indirect to direct in go.mod as a result.

* docs(backlog): refresh the race timeout measurements

re-measured during the PR #327 review: the app package now runs 81.5s and 87.5s
on master against 68s before, so headroom against the 100s budget is down from
roughly 32s to roughly 13s. Still later rather than yes, but the next addition
to the launcher matrix is what flips it.

* fix(highlight): lower the backtracking cap to 1m and correct its comment

10m covered roughly 1.7M characters, far past anything revdiff needs, and the
cost was not free. growTrack doubles until it reaches the cap, so the steps
before ErrBacktrackingStackLimit scale with it, while chroma sets a separate
250ms MatchTimeout on every rule and discards that error through the same
err == nil gate. A cap that large turns a sub-millisecond abort into a stall of
up to a quarter second on the bubbletea event loop, which themeselect hits on
every keypress that changes the chroma style.

The chroma Go quoted-string rule needs 240045 slots for the 40k test input, so
1m keeps about four times headroom and still fixes the regression.

Comment corrections that go with it: slots are ints, so 1m is about 8MB on
64-bit; the cap bounds runtrack only, since runstack grows through
doubleIntSlice with no limit check, so the two together reach roughly twice the
nominal budget; and the 250ms timeout is a second independent ceiling that
raising this constant cannot help. New's godoc now names the process-wide
change to regexp2.DefaultOptimizationOptions.