test: avoid regex in multipart boundary test

[jbeckwith-oai]

Summary

• replace the CodeQL-flagged multipart boundary regex with linear-time string operations
• continue asserting the exact multipart prefix, a non-empty boundary, and the RFC length limit
• keep the change test-only with no SDK runtime behavior changes

Addresses code scanning alert #1.

Root cause

The multipart encoding test extracted a library-generated boundary with /boundary=(.+)$/. CodeQL classified that regex as potentially polynomial on uncontrolled data. The boundary is fixed-length and generated internally, and the gem requires Ruby 3.2+, but the regex is unnecessary; direct prefix validation and removal express the invariant more precisely and avoid the flagged sink entirely.

Validation

• bundle exec rake test TEST=test/openai/internal/util_test.rb — 36 runs, 156 assertions, 0 failures
• bundle exec rake lint:rubocop — 2,537 files inspected, no offenses
• bundle exec ruby -c test/openai/internal/util_test.rb — syntax OK
• git diff --check — passed

The full generated-resource suite was also attempted, but it requires the external Steady mock server at localhost:4010; without that server, unrelated API tests fail with connection errors.

[openai-sdks]

OkTest Summary

✅ 237/237 SDK tests passed in 10.188s for Ruby SDK PR #304.

Test results — 42 files

Test	Result	Time
tests/chat-completions-complex-body.test.ts	✅ Passed	205ms
tests/chat-completions-create.test.ts	✅ Passed	317ms
tests/chat-completions-stream.test.ts	✅ Passed	163ms
tests/files-content-binary.test.ts	✅ Passed	320ms
tests/files-create-multipart.test.ts	✅ Passed	310ms
tests/files-list-pagination.test.ts	✅ Passed	183ms
tests/initialize-config.test.ts	✅ Passed	329ms
tests/instance-isolation.test.ts	✅ Passed	243ms
tests/models-list.test.ts	✅ Passed	337ms
tests/responses-background-lifecycle.test.ts	✅ Passed	269ms
tests/responses-body-method-errors.test.ts	✅ Passed	525ms
tests/responses-cancel-timeout.test.ts	✅ Passed	303ms
tests/responses-cancel.test.ts	✅ Passed	290ms
tests/responses-compact-retries.test.ts	✅ Passed	397ms
tests/responses-compact.test.ts	✅ Passed	328ms
tests/responses-create-advanced-stream.test.ts	✅ Passed	205ms
tests/responses-create-advanced.test.ts	✅ Passed	233ms
tests/responses-create-disconnect.test.ts	✅ Passed	170ms
tests/responses-create-errors.test.ts	✅ Passed	330ms
tests/responses-create-malformed-api-responses.test.ts	✅ Passed	162ms
tests/responses-create-retries.test.ts	✅ Passed	397ms
tests/responses-create-stream-failures.test.ts	✅ Passed	145ms
tests/responses-create-stream-timeout.test.ts	✅ Passed	240ms
tests/responses-create-stream-wire.test.ts	✅ Passed	2.006s
tests/responses-create-stream.test.ts	✅ Passed	149ms
tests/responses-create-terminal-states.test.ts	✅ Passed	368ms
tests/responses-create-timeout.test.ts	✅ Passed	290ms
tests/responses-create.test.ts	✅ Passed	380ms
tests/responses-delete.test.ts	✅ Passed	423ms
tests/responses-input-items-errors.test.ts	✅ Passed	199ms
tests/responses-input-items-list.test.ts	✅ Passed	182ms
tests/responses-input-items-options.test.ts	✅ Passed	297ms
tests/responses-input-tokens-count-timeout.test.ts	✅ Passed	303ms
tests/responses-input-tokens-count.test.ts	✅ Passed	269ms
tests/responses-malformed-inputs.test.ts	✅ Passed	2.135s
tests/responses-not-found-errors.test.ts	✅ Passed	398ms
tests/responses-parse.test.ts	✅ Passed	295ms
tests/responses-retrieve-retries.test.ts	✅ Passed	398ms
tests/responses-retrieve.test.ts	✅ Passed	345ms
tests/responses-stored-method-errors.test.ts	✅ Passed	932ms
tests/retry-behavior.test.ts	✅ Passed	2.021s
tests/sdk-error-shape.test.ts	✅ Passed	470ms

View OkTest run #29286973703

_{SDK merge (7b0f63747ad9) · head (472ddec1df7d) · base (6737a8875d53) · OkTest (cb7f0514ccd2)}

[HAYDEN-OAI]

thanks, this is a clean fix. the direct prefix check is stricter than the removed regex, keeps the non-empty and boundary-length assertions, and avoids the codeql sink without changing runtime code. the ruby 3.2 through 4.0 test matrix is green. approving!