Fix DS126858 false positive on --nomd5 and similar disable flags

[Copilot]

• Understand the current rule pattern and why it's matching --nomd5
• Update DS126858 rule pattern to use negative lookbehind to avoid matching MD5 when preceded by "no", "no-", "no_", or "disable_"
• Add test cases to must-not-match to validate --nomd5 and similar cases
• Run self-tests to verify the fix works correctly
• Validate that existing must-match cases still work
• Add word boundaries to negative lookbehind patterns to prevent edge cases like xnomd5
• Revert .gitignore change that added DevSkim-DotNet/nuget.config
• Add changelog entry for version 1.0.72

Original prompt

---

This section details on the original issue you should resolve

<issue_title>[False Positive] DS126858 flagging --nomd5</issue_title>
<issue_description>## DS126858

What the rule matched

makeself --sha256 --nomd5

Why should this not be matched?

makeself uses md5 checksums as a basic verification mechanism, I am trying to change it to a sha256 checksum. From the makeself documentation:

--sha256 : Adds a SHA256 checksum for the archive. This is in addition to the MD5 / CRC checksums unless --nomd5 is also used.

https://github.com/megastep/makeself</issue_description>

<agent_instructions>Try to improve the md5 rule to be less broad. It seems like it probably shouldn't capture this 'nomd5' case.</agent_instructions>

Comments on the Issue (you are @copilot in this section)

@gfs Thanks for your report. I'll take another look at the md5 rule and see if I can narrow it down a bit.

• Fixes [False Positive] DS126858 flagging --nomd5 #612

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

[gfs]

@copilot

[gfs]

@copilot please add a changelog entry for these changes

[Copilot]

@copilot please add a changelog entry for these changes

Added changelog entry for version 1.0.72 in commit c19e2a3