The commands-prefix group in rules 932100, 932105, 932106, and 932150
wrote the parenthesis branch as \s*\(\s* (whitespace on both sides) inside
a *-quantified alternation, so consecutive iterations could claim the same
whitespace run, forcing exponential backtracking in PCRE2. Rewrite each
branch to carry only a trailing \s* with no leading whitespace, so a run
of whitespace is consumed in exactly one place. Also drop the duplicate
\$.* alternative in the VARNAME=xyz branch.

Affected rules: 932100, 932105, 932106, 932150.

CRS attack-detection rules that inspect XML element text (`XML:/*`) do
not inspect XML attribute values (`XML://@*`). The two XPath expressions
are strictly disjoint, so payloads placed inside XML attribute values
bypass detection at every paranoia level.

This v3 LTS branch ships the fix gated behind an opt-in transaction
variable so operators can stage the change:

- 115 rules in 8 families (921, 930, 932, 933, 934-NODEJS, 941, 942,
  943) gain `|XML://@*` on the line that already targets `XML:/*`.
  The 944 (Java) family already inspected both and is unchanged.

- A runtime gate (id:901180, phase:2) strips `XML://@*` from the
  affected rules for each transaction when `tx.crs_xml_attr_inspect`
  is not set, preserving legacy LTS behavior by default.

- A commented opt-in `SecAction` (id:900510) is added to
  `crs-setup.conf.example`. Uncommenting it enables XML attribute
  inspection.

- Regression tests (FTW v1 schema) cover every changed rule via an
  XML body whose attack payload lives inside an attribute. The CI
  compose file injects the opt-in `SecAction` so tests run with
  inspection enabled.

…ES (#4693)

Rule 901181 (added in v3.3.10) uses the same ctl:ruleRemoveTargetByTag
with an '@'-containing target as v4.25.1's equivalent rule, and v3.3
supports running on nginx/libmodsecurity v3 (see tests/docker-compose.yml).
The v3.3.10 CHANGES.md entry only documented the ModSecurity v2 opt-out
limitation and was missing this separate, already-fixed parse-time
requirement that v4.25.1's CHANGES.md already has.