isISO8601 rejects T24:00:00 and accepts mixed separators #2858

Describe the bug

In the isISO8601 pattern, the end-of-day alternative 24:?00 sits outside
capture group 17, which is the group the seconds backreference \17 uses to
enforce a consistent separator. As a result the 24:00 branch is exempt from
the separator rule that every other hour is subject to.

This produces wrong verdicts in both directions:

• 2009-01-01T24:00:00 is rejected, although the test suite already asserts
  that 2007-04-05T24:00 is valid. Adding the seconds field to a form the
  project treats as valid makes it invalid.
• 2009-01-01T240030 and 2009-01-01T24:0030 are accepted, although they mix
  the basic and extended formats, which ISO 8601 does not permit. The
  equivalent mixture at any other hour is correctly rejected.

Examples

const validator = require('validator'); // 13.15.35

// Rejected, but 'T24:00' is in the valid list in test/validators.test.js
validator.isISO8601('2009-01-01T24:00:00'); // false, expected true
validator.isISO8601('2007-04-05T24:00');    // true

// Accepted, but they mix basic and extended format
validator.isISO8601('2009-01-01T240030');   // true, expected false
validator.isISO8601('2009-01-01T24:0030');  // true, expected false

// The same mixture at hour 23 is correctly rejected, which isolates the cause
validator.isISO8601('2009-01-01T23:59:59'); // true
validator.isISO8601('2009-01-01T235959');   // true
validator.isISO8601('2009-01-01T23:5959');  // false

The last three lines are the control: group 17 does its job for 23, so the
difference is the placement of the 24:?00 alternative, not the backreference
itself.

Reproductions

The Examples block above runs as-is on Node after
npm install [email protected]; no harness or scaffolding needed.

Additional context

Validator.js version: 13.15.35
Node.js version: v26.7.0
OS platform: Linux