[fix][core] keep the stored member language a language code

[ar2rsawseen]

What

The member language is stored by /user/settings/lang in frontend/express/app.js with no validation:

if (req.body.lang) {
    updatedUser.lang = req.body.lang;
    countlyDb.collection('members').update({"_id": ...}, {'$set': updatedUser}, ...);

That stored value then reaches file paths in around 25 readers. api/utils/localization.js sanitizes it in both getProperties and getProperty, but the two plugin localization lookups in plugins/plugins/api/api.js concatenate it as it comes:

local_path = fullpath + "/frontend/public/localization/" + resultObj.code + "_" + params.member.lang + ".properties";

Change

Two independent layers:

1. Validate where it is stored, so every reader inherits it. A language code is accepted, anything else is refused and the request answers false as it already does for a missing value.
2. Sanitize the two readers that build a path by hand, the same way localization.js already does.

A language code pattern rather than an allow list drawn from locale.conf.js, so a deployment shipping its own localization file keeps working, while leaving no way for path syntax to reach storage.

Why both layers

The value has around 25 readers across six files. Everything except these two goes through the sanitizing localization helpers or moment.locale, which is not a path. Fixing only the readers leaves the next reader exposed; fixing only the source leaves rows already stored. Doing both closes it now and keeps it closed.

Scope

Every reader of the stored language, with a verdict:

reader	verdict
api/utils/localization.js getProperties, getProperty	already sanitized
plugins/plugins/api/api.js plugin localization lookup	sanitized here
plugins/plugins/api/api.js plugins localization lookup	sanitized here
plugins/reports/api/utils.js getLocaleLangString	goes through locale.getProperty, sanitized
plugins/reports/api/reports.js moment.locale(lang)	not a path
api/parts/mgmt/mail.js, plugins/dashboards, plugins/star-rating	all via the localization helpers

Verification

The accepted pattern against real and hostile values:

• accepted: en, tr, de, zh, pt, pt-br, zh_CN, es
• refused: ../../../../etc/passwd, .., /tmp/x, en/../../x, en%2f.., empty, ., an 80 character name, en;rm -rf /

Lint clean on both changed files in each repo. No behaviour change for the dashboard, which only sends codes from its own list.