security: validate custom node pack names

[Ersa-tech]

Summary

Validates custom node pack names before using them in filesystem paths during install and uninstall operations.

Security impact

The custom node installer derived pack_name directly from the submitted git source and then used it for clone targets, module loading, tags, and cleanup paths. This change rejects empty names, dot segments, path separators, and unsafe characters before any filesystem operation is attempted.

This is especially important on Windows, where backslashes in a URL segment can be interpreted as path separators when building Path targets.

Changes

• Add a shared pack-name validator.
• Use it when deriving names from install sources.
• Use it before uninstall path construction.
• Add regression coverage for valid git URLs, empty names, dot segments, and Windows separator traversal.

Verification

• python -m py_compile invokeai/app/api/routers/custom_nodes.py tests/app/routers/test_custom_nodes.py

I could not run the focused pytest module locally because the checkout is missing the blake3 dependency before test collection reaches this module.