fix(modules): guard regex extractor against negative group index (#346)

a module with a negative extractor group indexed matches[e.Group] past
the lower bound, panicking the executor goroutine and crashing the whole
scan. the existing bound only checked the upper end; check e.Group >= 0
too so an invalid group is skipped like an out-of-range one.

internal/modules/executor.go

@@ -508,7 +508,7 @@ func runExtractors(extractors []Extractor, resp *http.Response, body string) map
 					continue
 				}
 				matches := re.FindStringSubmatch(part)
-				if len(matches) > e.Group {
+				if e.Group >= 0 && len(matches) > e.Group {
 					result[e.Name] = matches[e.Group]
 					break
 				}

internal/modules/matchers_test.go

@@ -338,6 +338,14 @@ func TestRunExtractors(t *testing.T) {
 			},
 			wantNil: true,
 		},
+		{
+			// a negative group must be skipped, not panic on matches[-1].
+			name: "negative group is skipped",
+			extractors: []Extractor{
+				{Type: "regex", Name: "session", Part: "body", Regex: []string{`"session":"([^"]+)"`}, Group: -1},
+			},
+			wantNil: true,
+		},
 		{
 			name: "invalid pattern is skipped, no capture",
 			extractors: []Extractor{