olevba: don't describe _Click handlers as running on document open - #896

What is wrong

AUTOEXEC_KEYWORDS_REGEX puts every ActiveX/control event into one group described as "Runs when the file is opened and ActiveX objects trigger events", and \w+_Click is one of them:

'Runs when the file is opened and ActiveX objects trigger events':
    (r'\w+_GotFocus', r'\w+_LostFocus', r'\w+_MouseHover', r'\w+_Click',
     r'\w+_Change', r'\w+_Resize', ...),

CommandButton1_Click fires when the user clicks the control and at no other time. A document whose only macro entry point is a button therefore gets reported as having code that runs when the file is opened — and the wording gets carried downstream, into reports and summaries, as evidence of auto-execution when no Workbook_Open / Auto_Open / Document_Open path exists at all.

Fixes #891.

What I changed

Split \w+_Click into its own entry:

# Interaction-only events. A \w+_Click handler fires when the user clicks an
# embedded control, never on document load, so it must not be described as
# running when the file is opened. Detection is unchanged (added in #499).
'Runs when the user interacts with an embedded ActiveX control (e.g. clicks a button)':
    (r'\w+_Click',),

Wording taken verbatim from your suggestion in the issue. Detection is unchanged — \w+_Click still matches and is still reported as AutoExec, exactly as #499 introduced it. Only the description differs.

Why only _Click

The rest of the group is not so clear-cut. _GotFocus, _LostFocus, _Resize and _Layout can plausibly fire while a control is initialised or rendered as a document loads, so "runs when the file is opened" is defensible for them. _Click is the one that unambiguously cannot.

Two others in the group look interaction-only to me — _Change (fires when the user edits a control's value) and _FollowHyperlink (fires on a link click) — but I left them alone rather than widening the diff beyond what the issue asked for. Say the word and I will split those too.

Tests

tests/olevba/test_autoexec.py, five cases calling detect_autoexec directly:

unmodified master:     2 failed, 3 passed
with the change:       5 passed
tests/olevba/ (whole): 11 passed, 1 skipped in 2.74s

The two failures on master are the description assertion and the combined-file assertion, both showing 'Runs when the file is opened and ActiveX objects trigger events' where the interaction text is expected.

Aside

You noted in the issue that the autoexec patterns are hand-synced between olevba's keyword table and mraptor's re_autoexec regex. I checked: mraptor emits only A/W/X flags and has no _Click in re_autoexec, so it is untouched here. The drift risk is real but independent, as you said.