Add input-hygiene checks for CLI arguments and API path parameters

[shwetamurali]

Description

Adds a lightweight, shared input-hygiene layer that rejects control characters (including ANSI escape sequences) and invalid UTF-8 in user-supplied positional arguments and -p API path parameters. This keeps malformed values out of outgoing requests and out of any text tfctl echoes back to a terminal or audit log, like the noninteractive-delete audit line in api. This is input hygiene, not a security boundary. Authorization is still enforced server-side by the API token. These checks only ensure inputs are well-formed printable text.

What changed

• New internal/pkg/inputguard package:Validate(s) rejects invalid UTF-8 and control characters. Errors render the offending value with %q (escaping control chars rather than writing them raw) and truncate at 80 chars.
• Framework wiring: positional arguments are validated in Command.Run() after arg-count validation and before RunF. Failures print via the standard ErrorLabel() + usage and exit 1.
• Opt-out:PositionalArguments.SkipInputValidation for commands that legitimately pass arbitrary bytes through. Applied to harness exec, whose COMMAND is a verbatim child command line.
• Path params:client.ResolvePathParams validates each -p value before substitution (invalid value for path param {…}).

Testing

• New unit tests for inputguard.Validate, the Command.Run guard (including the skip opt-out), and ResolvePathParams value validation.

Example Output

PR Checklist

• Run npx changie new or install changie to prepare a new changelog entry for the next set of release notes.
• Ensure any command changes are sensitive to these global flags:
  • --json — Force machine readable output to stdout. Does not apply to stderr.
  • --markdown — Force markdown output to stdout. Does not apply to stderr.
  • --dry-run — Don't make any actual writes or other mutations. Describe what would have changed to stderr.
  • --quiet — Don't render output to stdout.
• Get the logging interface from the context and add debug logging for interesting conditions and nonfatal situations.
• Run make gen/screenshot if the root command output changes.
• Add the Autocomplete field to positional arguments and flags to assist shell autocomplete.

PCI review checklist

• I have documented a clear reason for, and description of, the change I am making.

• If applicable, I've documented a plan to revert these changes if they require more than reverting the pull request.

• If applicable, I've documented the impact of any changes to security controls.

  Examples of changes to security controls include using new access control methods, adding or removing logging pipelines, etc.

[brandonc]

I like the thoughtfulness for harness exec