Fix path traversal via username in session log file paths

Registration only validated username with NotBlank, so a username
like "../../../../public/x" got concatenated directly into a
filesystem path for both writing (game activity logs) and reading
(admin log viewer) - reachable from the public webroot since public/
is a few directories up from where those logs are stored.

Adds a character-set validator (letters, numbers, underscore, hyphen)
to registration and admin user editing going forward, and sanitizes
at the point of use (Player::getLogFileBasename()) so any
already-stored unsafe username can't escape the log directory either.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

src/Game/Controller/GameAdminController.php

@@ -54,11 +54,10 @@ final class GameAdminController extends AbstractController
     {
         $playersLogs = [];
         foreach ($session->getPlayers() as $player) {
-            $username = $player->getUser()->getUsername();
-            $logFile = $this->projectDir . '/var/log/sessions/' . $session->getId() . '/' . $username . '.txt';
+            $logFile = $this->projectDir . '/var/log/sessions/' . $session->getId() . '/' . $player->getLogFileBasename() . '.txt';
 
             $playersLogs[] = [
-                'username' => $username,
+                'username' => $player->getUser()->getUsername(),
                 'logs' => file_exists($logFile) ? file_get_contents($logFile) : '',
             ];
         }