Add timeout values to all regex expressions

[blowdart]

To avoid regex attacks add a time-out value to every regular expression in the code base.

[ChengTian]

I remember @blowdart finds that currently we are unable to add this to CoreCLR version of runtime.

Should be a post-beta5 issue.

@muratg , do we want a Security label for this kind of issue, or just use Bug?

[blowdart]

I'd stick with bug.

As for CoreCLR this is not true. CoreCLR does not provide a global default. You can, and should, in both desktop and core use the regex constructor which takes the Timeout everywhere.