Fix project hashtag regexp to stop matching terminal periods

Summary:
Fixes T6416. The comment is consistent with intent, but the actual regexp doesn't quite work right. In particular, we incorrectly match #security. as security. (with a period) instead of security (with no period).

Since this stuff is a pain to test and I evidently got it wrong in this case in D8703, make it unit testable.

Test Plan:
Added unit tests. Also:

Reviewers: chad, btrahan

Reviewed By: btrahan

Subscribers: epriestley

Maniphest Tasks: T6416

Differential Revision: https://secure.phabricator.com/D10753