fix(parser): make Python call extraction linear

[alxxjohn]

Motivation

• The previous call extraction scanned the remainder of a logical statement for every call match, producing O(n^2) CPU cost on nested or unterminated call sequences and enabling a scan DoS from attacker-controlled Python files.
• Call span discovery and argument splitting must be made linear-time to avoid excessive CPU for large/malformed inputs while preserving parsing semantics.

Description

• Replace per-match rescans with a single-pass pythonCallSpans that computes each call's closing bracket and top-level comma positions and introduce pythonCallSpan to represent those spans.
• Compute call line numbers incrementally instead of repeatedly counting newlines from the start, and extract args using a cached-trim strategy to avoid repeated trimming work.
• Add ExtractCalls wrapper (keeps API) and import unicode to improve whitespace trimming, and preserve existing behavior for call names and keyword filtering.
• Add regression test TestExtractCallsHandlesNestedAndMalformedCalls to cover nested calls, multiline call locations, and large malformed sequences that previously triggered quadratic behavior.

Testing

• Ran go test ./tests/support ./internal/codeguard/checks/support and the tests passed.
• Ran go test ./... and go vet ./... with no failures reported.
• Ran git diff --check to ensure no formatting or whitespace issues and found none.

---

Codex Task