fix(renderer): remove ambiguous \s* from _BLOCK_RE to prevent ReDoS

The pattern \s*(.*?)\s* allowed polynomial backtracking when no closing
*> delimiter was found — confirmed to hang at n=5000 whitespace chars.
The \s* wrappers were redundant since group(1) is already stripped at
the call site (line 278).

Reported and patched with @pa1va. Closes #2323

Scripts/python/src/theming/lib/renderer.py

@@ -138,7 +138,7 @@ class TemplateRenderer:
     COLOR_ARG_FILTERS = {"blend", "harmonize"}
 
     # Regex for block delimiters: <* ... *>
-    _BLOCK_RE = re.compile(r'<\*\s*(.*?)\s*\*>', re.DOTALL)
+    _BLOCK_RE = re.compile(r'<\*(.*?)\*>', re.DOTALL)
 
     # Regex for expression tags: {{ ... }}
     _EXPR_RE = re.compile(r"\{\{\s*([^}\n]+?)\s*\}\}")