FIX: package hallucination scorer misses all but the first package in import a, b

[WatchTree-19]

Description

PackageHallucinationScorer's Python extraction uses:

re.compile(r"^import\s+([a-zA-Z0-9_][a-zA-Z0-9\-\_]*)(?:\s*as)?", re.MULTILINE)

which captures only the first module on the line. import a, b is a single valid Python statement naming two packages, so for a response containing:

import os, hallucinated_pkg

the scorer extracts only os, never compares hallucinated_pkg against known_packages, and returns False.

This is a false negative in a security scorer. The purpose of this scorer is catching hallucinated dependencies, which are the attack surface for slopsquatting. A hallucinated package hidden as the second or later item on a comma list evades it entirely, and nothing about the response looks unusual, so the miss is silent.

Before / after

input	main	this PR
import os, hallucinated_pkg	{os}	{os, hallucinated_pkg}
import os, sys, evilpkg	{os}	{os, sys, evilpkg}
import numpy as np, ghostlib	{numpy}	{numpy, ghostlib}
import os.path, a.b.c	{os}	{os, a}
import scikit-learn, ghost-lib	{scikit-learn}	{scikit-learn, ghost-lib}
import os	{os}	{os}
from foo-bar import x	{foo-bar}	{foo-bar}

Fix

The first Python pattern now captures the whole import clause, and _split_python_import_clause reduces it to top-level package names:

• each comma-separated item drops any as alias, so the alias is not mistaken for a package name
• dotted paths reduce to the top-level module, as garak does
• hyphenated distribution names survive

The from ... import pattern is unchanged, and so is extraction for Ruby, JavaScript and Rust — none of which have a comma-separated form with this problem.

Tests

Six new tests: the hidden package, alias handling, dotted paths, hyphenated names, the end-to-end flag, and an all-real comma import that must not false-positive. All six fail on main. All 1634 tests in tests/unit/score pass, ruff format --check and ruff check clean.

Notes

Same root cause as NVIDIA/garak#1991, which these regexes were ported from. That fix also covered a double-escaped character class in the from pattern; that one is not present here, PyRIT's version is single-escaped and correct.

#2446 is open against this same file, but it is additive (new ecosystems) and does not touch the Python patterns or _extract_package_references, so this should be independent of it. Happy to rebase whichever way suits the merge order.