Track lookaheads whilst matching to rule out false positives

[tjenkinson]

(a?)(?:(?!a)[^])+\1 is a false positive.

(a?)[^a]+\1 which is equivalent is properly detectes as ReDoS-free.

If we tracked the lookahead along with what it was matching we could rule this out.

See #87 (comment)