Guard against negative capture group in regexp string transform

[arpitjain099]

What this does

stringRegexpTransform picks a capture group by index. The bounds check only covers the upper end:

g := ptr.Deref[int](r.Group, 0)
if len(groups) == 0 || g >= len(groups) {
    return "", errors.Errorf(errStringTransformTypeRegexpNoMatch, r.Match, g)
}
return groups[g], nil

Group is a *int, so a Composition can set it to a negative value. A negative g passes both len(groups) == 0 and g >= len(groups), then groups[g] panics with an index out of range.

This adds the missing lower-bound check (g < 0) so a negative group returns the existing no-match error instead of panicking.

Testing

Added a test case with Group: -1. Without the fix it panics:

panic: runtime error: index out of range [-1]
    ... stringRegexpTransform ... transforms.go:399

With the fix go test ./... passes and the negative group returns the no-match error like an out-of-range positive group already does.

[bobh66]

Fix CI

[arpitjain099]

Rebased on main. The break was my test case: main no longer imports k8s.io/utils/ptr, and my line still called ptr.To[int](-1), so the merged result failed vet with undefined: ptr. It now uses the local new(-1) helper like the two cases above it. go test ./... passes locally.