one detection result per output when testing regex based matches in exploitation

[jmartin-tech]

Fixes #1165

Verification

List the steps needed to make sure this thing works

• Verify updated unit test passes for with single detection.

[leondz]

models like to continue output. this means quite a few positives from this probe that don't indicate a system-level threat.

• is the setup a Tier 1 as-is?
• cf. ansiescape and its raw vs. escaped forms - the same phenomenon can present differently with different risk levels. is tier really an attribute of a probe-detector pair rather than probe alone? consider that probes often have multiple detectors looking for different things

tagging @erickgalinkin for vis

[erickgalinkin]

LGTM