Fix path traversal via username in session log file paths

Registration only validated username with NotBlank, so a username
like "../../../../public/x" got concatenated directly into a
filesystem path for both writing (game activity logs) and reading
(admin log viewer) - reachable from the public webroot since public/
is a few directories up from where those logs are stored.

Adds a character-set validator (letters, numbers, underscore, hyphen)
to registration and admin user editing going forward, and sanitizes
at the point of use (Player::getLogFileBasename()) so any
already-stored unsafe username can't escape the log directory either.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

tests/Game/SessionLoggingTest.php

@@ -74,6 +74,7 @@ class SessionLoggingTest extends TestCase
         $player->method('getUser')->willReturn($user);
         $player->method('getSession')->willReturn($session);
         $player->method('getScreen')->willReturn(1);
+        $player->method('getLogFileBasename')->willReturn('player1');
 
         $this->security->method('getUser')->willReturn($user);
         $this->playerService->method('GetCurrentlyActiveAsPlayer')->willReturn($player);