feat(three-stage-scan): add split-sink fixtures the regex scan misses

benchmarks/fixtures/split-sink-c/src/vuln.c

@@ -0,0 +1,8 @@
+#include <stdio.h>
+#include <sqlite3.h>
+
+void search(sqlite3 *db, char *term) {
+  char query[512];
+  snprintf(query, sizeof(query), "SELECT * FROM items WHERE title LIKE '%%%s%%'", term);
+  sqlite3_exec(db, query, 0, 0, 0); /* CWE-89 split-sink: query built on prior line (regex blind spot) */
+}