Validate untrusted IDs before using them as directory names

Texture pack installs took the destination directory from the archive's
textures.ini, and PKG update installs from the PBOOT's DISC_ID, both
unchecked, so a crafted archive or package could write outside
PSP/TEXTURES or PSP/GAME. Add IsSafePathComponent() to PathUtil and check
both, replacing the WebServer's own upload filename check with it too.

DISC_ID from any PARAM.SFO also names configs, cheats, textures, exdata
and savestates, so ReadSFO now drops one that isn't a safe name and the
game gets a fake ID like homebrew. The same goes for a frame dump's ID.

Combines #22419 and #22420 by Acts1631.

Co-Authored-By: Acts1631 <acts1631kjv@proton.me>
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

Core/Util/GameManager.cpp

@@ -496,6 +496,11 @@ bool GameManager::DetectTexturePackDest(struct zip *z, int iniIndex, Path &dest)
 			}
 		}
 	}
+	// The ID comes from the archive and becomes a directory name.
+	if (!IsSafePathComponent(gameID)) {
+		SetInstallError(iz->T("Texture pack doesn't support install"));
+		return false;
+	}
 
 	Path pspTextures = GetSysDirectory(DIRECTORY_TEXTURES);
 	dest = pspTextures / gameID;