fix: sanitize openresty include filenames to prevent eval injection

Add defense-in-depth sanitization for OpenResty include files to prevent
OS command injection via malicious filenames that break shell quoting in eval.

- Add filename validation in core-post-extract using regex [^a-zA-Z0-9_.-]
- Validate both http-includes and location-includes paths
- Abort deploy via dokku_log_fail on unsafe filenames
- Skip non-regular files (symlinks, directories) during extraction
- Add security regression test with unsafe filename containing space
- Keep existing guards in docker-args-process-deploy as belt-and-suspenders
- Update documentation to clarify allowed filename characters

Addresses CVSS 9.9 vulnerability where filenames like poc'$(cmd)'x.conf
could escape shell quoting and execute arbitrary commands during deploy.

plugins/openresty-vhosts/docker-args-process-deploy

@@ -43,6 +43,18 @@ trigger-openresty-vhosts-docker-args-process-deploy() {
         continue
       fi
 
+      # check that filename includes only alphanumeric characters, underscores, and dots
+      if [[ "$filename" =~ [^a-zA-Z0-9_.-] ]]; then
+        dokku_log_warn "Skipping include file with non-alphanumeric characters: $filename"
+        continue
+      fi
+
+      # check that filename does not contain any special characters
+      if [[ "$filename" =~ [\'\"\ \$\`\(\)\;] ]]; then
+        dokku_log_warn "Skipping include file with unsafe filename: $filename"
+        continue
+      fi
+
       DATA="$(base64 -w 0 <"$include_dir/$filename")"
       output="$output '--label=openresty.include-http-$filename=$DATA'"
     done
@@ -61,6 +73,18 @@ trigger-openresty-vhosts-docker-args-process-deploy() {
         continue
       fi
 
+      # check that filename includes only alphanumeric characters, underscores, and dots
+      if [[ "$filename" =~ [^a-zA-Z0-9_.-] ]]; then
+        dokku_log_warn "Skipping include file with non-alphanumeric characters: $filename"
+        continue
+      fi
+
+      # check that filename does not contain any special characters
+      if [[ "$filename" =~ [\'\"\ \$\`\(\)\;] ]]; then
+        dokku_log_warn "Skipping include file with unsafe filename: $filename"
+        continue
+      fi
+
       DATA="$(base64 -w 0 <"$include_dir/$filename")"
       output="$output '--label=openresty.include-location-http-$filename=$DATA'"
     done