chore(sync): add id and path constraints for synced data

[kwburns-kong]

Adds constraints on ids, names and paths in synced data, aligned with the matching backend changes.

Cloud sync (insomnia-vcs, main/cloud-sync):

• Blob ids and snapshot ids must be 40 lowercase hex characters, for example da39a3ee5e6b4b0d3255bfef95601890afd80709.
• Backend project ids must match ^[A-Za-z0-9_-]{1,128}$, for example prj_f6e7712ab6604da9a3ec744290a699ba.
• Branch names used for store keys cannot contain \, NUL, or . / .. segments.
• Pulled docs need _id and parentId matching ^[A-Za-z0-9_-]{1,255}$.
• The file system store keeps its keys inside the store directory.

Git sync (sync/git, main/git-service):

• Paths used by the git fs client stay inside the working directory, including through symlinks.
• Doc ids are checked before writing to the database for the legacy .insomnia migration (applied all-or-nothing), git yaml imports, the legacy NeDB git client, and the legacy workspace id of a cloned repo.
• cloneGitRepoAction always flushes the change buffer when it exits early.

Other:

• gRPC: synced proto doc ids are checked before being used in temp file paths.
• restoreBackup: the version must be a single directory name under backups.
• api.protocol: decoded asset paths stay within the client root.

Tests: added unit tests for each constraint. insomnia-vcs tests, insomnia tests, type-check and lint pass.