fix: validate filesystem catalog identifiers

[fallintoplace]

What changed

This adds path-safe identifier validation helpers and enforces them in FileSystemCatalog before database or table paths are constructed.

The existing Identifier::new API remains infallible and compatible. FileSystemCatalog now rejects database and object names that are empty or whitespace-only, ., .., contain / or \, or contain control characters before using them in database_path or table_path.

C/Go binding identifier constructors remain compatible and do not reject path-control names at identifier construction time. Unsafe names are rejected when they are used with FileSystemCatalog operations.

Why

Filesystem catalog paths are derived from database and table names. Without validation, path-control input can escape the intended warehouse namespace on local filesystem storage.

Fixes #333.

Validation

• cargo fmt --all -- --check
• cargo check -p paimon --all-targets
• cargo test -p paimon catalog::
• cargo clippy --all-targets --workspace --features fulltext,vortex -- -D warnings
• git diff --check

[JingsongLi]

Why not just in Identifier.new?

[fallintoplace]

Good point. I will implement this.

[JingsongLi]

After the signature modification, this is indeed a major change. Perhaps we should still keep Identifier:: new() invincible (without changing the signature) and only perform validation in the entry method of the FileSystemCatalog. (RESTCatalog will have validation in server side.)

[JingsongLi]

+1