Potential fix for code scanning alert no. 14: Uncontrolled data used in path expression

[xdrew87]

Potential fix for https://github.com/xdrew87/nexusintel/security/code-scanning/14

General fix: ensure any user-derived path component is transformed into a strictly safe filename/path-segment form (allowlist + normalization) before being used in path expressions, and only use the sanitized value downstream.

Best fix here (without changing functionality):
In backend/api/routes/evidence_router.py, add a dedicated sanitize_path_segment helper and use it for investigation_id before building upload_dir. Keep existing containment checks. This makes the sanitization explicit and deterministic, reducing taint concerns and preserving behavior (alphanumeric, _, - IDs only).

Changes needed:

• Add new helper function near existing sanitize_filename.
• Replace current regex id_match block in upload_evidence with call to new sanitizer and same 400 response on invalid input.
• No new imports or dependencies required.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.