fix: limit overly permissive regex range

[barmac]

Proposed Changes

This fragment of code deals with letters so it should not match additional characters.

Checklist

To ensure you provided everything we need to look at your PR:

• Brief textual description of the changes present
• Visual demo attached
• Steps to try out present, i.e. using the @bpmn-io/sr tool
• Related issue linked via Closes {LINK_TO_ISSUE} or Related to {LINK_TO_ISSUE}

[barmac]

I'll check if it's not breaking bpmn-js, but should be safe to merge.

[barmac]

Testing on bpmn-js via https://github.com/bpmn-io/bpmn-js/actions/runs/11815595868

[barmac]

I had to skip types test as they are apparently not generated for install from commit. This is the new run: https://github.com/bpmn-io/bpmn-js/actions/runs/11815660568

[barmac]

A manual smoke test did not reveal any issues.

[nikku]

I propose we add a dedcated test case for this, i.e. verify our replace strategy. Not 100% sold on whether this is actually a bug worth fixing.

For this to ever be an issue we'd need to get elements from untrusted input.

[barmac]

I'll add a test case for this util.

[barmac]

Test cases added via 06db3c7

[nikku]

Good one, thanks!