[bug] Validate extra file paths in configuration schema

[nemesifier]

Describe the bug
The files[].path field accepted paths that should not be used in generated OpenWrt configuration archives.

Examples currently accepted:

tmp/x; reboot
../../../etc/passwd
tmp/a b
tmp/$(reboot)

Some of these are technically possible filenames on Linux, but they are not useful or safe configuration file paths for OpenWISP.

netjsonconfig should reject them during validation.

Steps To Reproduce
Steps to reproduce the behavior:

1. Use this minimal config:

   {
     "files": [
       {
         "path": "tmp/x; reboot",
         "mode": "0644",
         "contents": "test"
       }
     ]
   }

2. Validate or generate it with the OpenWrt backend.

3. The path is accepted and written into the generated archive.

Expected behavior
files[].path should only accept safe configuration paths.

Suggested rules:

• allow absolute or relative paths
• reject empty path components
• reject . and .. components
• reject whitespace and control characters
• reject shell metacharacters
• allow common path characters: letters, digits, ., _, -, /
• allow { and } if template variables in paths are supported

Example valid paths:

/etc/config/network
etc/openvpn/client.conf
{{cert_path_abc123}}

Example invalid paths:

tmp/x; reboot
../../../etc/passwd
tmp/a b
tmp/$(reboot)

Screenshots
Not applicable.

System Informatioon:

• OS: any
• netjsonconfig version: current master

[openwisp-companion]

This issue has been automatically assigned to @nemesifier who opened PR #401 to address it. 🎯