fix(validation): fix two P-025 false positives on real-world feature-file lines

[hdamker]

What type of PR is this?

bug

What this PR does / why we need it:

check_feature_file_url_version (P-025) and check_server_url_version (P-004) share one regex helper that captures the whole path segment following {api-name}/. P-004 applies it with .search() — first match only. P-025 applied it with .finditer() — every match in the line, which misfires when the API name recurs later in the same line as a resource-collection segment (e.g. a qos-profiles API whose own resource path is /qos-profiles/vwip/qos-profiles/{name}): the correct vwip match is found first, but the second, unrelated {name} match then gets flagged as a wrong version segment.

Fix (commit 1): P-025 now takes a single .search() per line, matching P-004's existing semantics. Every line is still scanned independently (a feature file legitimately repeats the api-name+version pattern across many scenario steps) — only the within-line multiple-match case is removed.

While evaluating the blast radius of the above across all CAMARA API repositories, a second, distinct false positive turned up: P-025 scans every raw line unconditionally, with no notion of "is this an actual step." A # comment documenting the raw operation (e.g. # Operation: GET /network-access-devices/{id}) is not a scenario step and carries no version segment to check, but still matched the pattern and got flagged.

Fix (commit 2): skip a line early when its stripped content starts with #, before running the version-segment check against it.

Which issue(s) this PR fixes:

Fixes #394

Special notes for reviewers:

• Added test_main_same_line_api_name_reused_as_resource_segment (commit 1) and test_main_comment_line_skipped (commit 2), each reproducing its exact real-world case (red before the corresponding fix, green after).
• test_multiple_lines_collect_all_findings (separate lines, each contributing its own finding) stays green throughout both commits — confirms neither fix touches cross-line scanning.
• Blast-radius check across all locally available CAMARA API repositories (both fixes, run against real repo content): the same-line-reuse false positive was live in QualityOnDemand (qos-profiles) and NetworkAccessManagement (network-access-devices, which also carried the comment-line false positive on the same file); one unrelated, genuine version-segment typo remains untouched (KnowYourCustomer, kyc-fill-in.feature:28, v0.3rc1 vs expected v0.3) — confirming both fixes are precisely scoped, with no findings lost.
• Full validation/tests suite: 1218 passed.

Changelog input

 release-note
Fixed two P-025 false positives: a feature-file scenario step that reuses the API name as a resource-path segment later in the same line, and a comment line documenting the raw operation being misread as a scenario step.

Additional documentation

This section can be blank.

docs