Replace the backtracking _PEM_BLOCK regex with a forward-only scanner that indexes END markers by label, so repeated unterminated headers do not cause the regex to rescan the remaining input. Impact: 80 KiB payload went from 8.34 s to 0.001 s.
