fix(validate): add input validation for upgradeId and userType

[Sertug17]

The validate route was missing the safe path pattern check that
install-deps/route.ts and upgrade config/route.ts both use.

upgrade-config/route.ts:27-28 validates both network and upgradeId
with /^[a-zA-Z0-9_-]+$/. The validate route only checks for non-empty
strings it passes upgradeId and userType directly into filesystem
paths (via validation-service.ts), relying solely on assertWithinDir
for path traversal protection.

Add the same ^[a-zA-Z0-9_-]+$ regex validation to upgradeId and
userType for defense-in-depth consistency with the other API routes.

[cb-heimdall]

🟡 Heimdall Review Status

Requirement	Status	More Info
Reviews	🟡 0/1	Denominator calculation Show calculation 1 if user is bot 0 1 if user is external 0 2 if repo is sensitive 0 From .codeflow.yml 1 Additional review requirements Show calculation Max 0 0 From CODEOWNERS 0 Global minimum 0 Max 1 1 1 if commit is unverified 1 Sum 2