Unvalidated path_friendly_name lets a build delete and write outside build_dir #17

project.path_friendly_name is a plain str with no validation. It's joined onto build_dir to name every stage directory, and those directories are deleted before being rewritten. A name containing .. or a path separator therefore makes the build delete and write files outside build_dir.

Relevant code: models/config.py, lines 112–126, build_project/__init__.py, lines 61 and 78–108,`` and the deletion in inputs/code.py, lines 65–66.```

Reproduction in an isolated temporary directory:

1. Create proj/build/, proj/game/pxt.json, and an unrelated proj/victim-source/important.txt.
2. Use a config with path_friendly_name: "../victim", build_dir: proj/build and a path source of proj/game. The config loads without error.
3. Run mkcd2app build. proj/victim-source/important.txt is deleted and replaced by the game source. victim-binary-js-build, victim-binary-js-support, victim-website and victim-website-deps are created next to build_dir instead of inside it.

This is a different path to deletion from #9, which is about --full-rebuild and build_dir: ".".

The same field also becomes the website's package.json name (website.py, line 175), which npm requires to be lowercase and URL-safe. It will also be the base of the Electron/Tauri product and binary names, so an empty string or spaces cause trouble even without ...

Expected behavior: Project rejects names that aren't a single safe path component when the config loads, for example with a pattern like ^[a-z0-9][a-z0-9._-]*$ that also satisfies npm's package-name rules.

Found while reviewing PR #7, toolchain at ce12c48.