Validate package names before database queries

[andrew]

Most handlers only check for empty package names. Add validation for null bytes, length limits, and format-specific naming rules (e.g. npm scoped package structure) after URL decoding and before hitting the database.