Prevent string.match() ReDoS

upper limit of times the matcher can backtrack

Signed-off-by: katlogic <kat@lua.cz>