fix: sanitize openresty include filenames to prevent eval injection

Add defense-in-depth sanitization for OpenResty include files to prevent
OS command injection via malicious filenames that break shell quoting in eval.

- Add filename validation in core-post-extract using regex [^a-zA-Z0-9_.-]
- Validate both http-includes and location-includes paths
- Abort deploy via dokku_log_fail on unsafe filenames
- Skip non-regular files (symlinks, directories) during extraction
- Add security regression test with unsafe filename containing space
- Keep existing guards in docker-args-process-deploy as belt-and-suspenders
- Update documentation to clarify allowed filename characters

Addresses CVSS 9.9 vulnerability where filenames like poc'$(cmd)'x.conf
could escape shell quoting and execute arbitrary commands during deploy.

tests/unit/openresty.bats

@@ -253,6 +253,24 @@ teardown() {
   assert_output_contains "charset UTF-8;"
 }
 
+@test "(openresty) [security] eval injection via malicious include filename" {
+  rm -f /tmp/openresty-include
+
+  run /bin/bash -c "dokku proxy:set $TEST_APP openresty"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run deploy_app python dokku@$DOKKU_DOMAIN:$TEST_APP add_openresty_include_unsafe
+  echo "output: $output"
+  echo "status: $status"
+  assert_failure
+  assert_output_contains "unsafe filename" -1
+
+  # No injection payload to test since we're using a simple space character
+  # The test should have failed during core-post-extract, not during eval
+}
+
 @test "(openresty) label management" {
   run /bin/bash -c "dokku proxy:set $TEST_APP openresty"
   echo "output: $output"
@@ -335,3 +353,16 @@ add_openresty_include() {
   touch "$APP_REPO_DIR/openresty/http-location-includes/example.conf"
   echo "# location-block" >>"$APP_REPO_DIR/openresty/http-location-includes/example.conf"
 }
+
+add_openresty_include_unsafe() {
+  local APP="$1"
+  local APP_REPO_DIR="$2"
+  [[ -z "$APP" ]] && local APP="$TEST_APP"
+
+  mkdir -p "$APP_REPO_DIR/openresty/http-includes"
+  # Create a filename with a space - simpler test that should be rejected by [^a-zA-Z0-9_.-]
+  printf 'charset UTF-8;\n' >"$APP_REPO_DIR/openresty/http-includes/unsafe filename.conf"
+
+  mkdir -p "$APP_REPO_DIR/openresty/http-location-includes"
+  printf '# location\n' >"$APP_REPO_DIR/openresty/http-location-includes/unsafe filename.conf"
+}