Potential fix for code scanning alert no. 1: Uncontrolled data used in path expression

[kelsoncm]

Potential fix for https://github.com/kelsoncm/sc4/security/code-scanning/1

To fix this robustly without changing intended functionality, enforce a strict filename allowlist before building the file path (only plain filenames with safe characters, no separators), and continue using the existing canonicalization + containment check. This removes ambiguity and makes the sanitization explicit to both humans and static analyzers.

In sc4net/tests/mocks.py, update do_GET:

• after extracting filepath, derive safe_filepath with os.path.basename(filepath) (single-file semantics),
• reject invalid names via a regex allowlist (e.g., ^[A-Za-z0-9._-]+$),
• keep the existing realpath(join(...)) and commonpath checks,
• then proceed with exists/open.

Also add import re at the top for validation.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.