Potential ReDoS in ActorParser: quadratic backtracking on crafted Person:/Organization: values #907

The actor regexes at src/spdx_tools/spdx/parser/actor_parser.py:17-18

r"^Person:\s*(?:(.*)\((.*)\)|(.*))$"
r"^Organization:\s*(?:(.*)\((.*)\)|(.*))$"

backtrack quadratically on a value containing a long run of '(' with no
closing ')'. Every SPDX format routes creators through this parser, so a
crafted Creator: line in an uploaded SBOM pins one CPU core for an
attacker-controlled duration (I measured ~80s per core on a ~160 KB
creator value). CWE-1333.

I have a self-contained repro and would like to go through normal
coordinated disclosure. Is there a preferred private channel (GitHub
advisory, email), or should I send details to the maintainer list? I'll
hold details for 90 days from this post; can share a patch sketch now if
maintainers want to start on the fix.

Best,
James (https://github.com/SirLiftington)