pakfire.cgi: Check user given package list for invalid characters.
Check the user given list of packages which should be installed or
removed for any unallowed characters.
Otherwise the list could contain manipulated elements, which will be passed to
the shell which calls the pakfire instance. This allows an attacker which is authenticated
to the WUI to perform RCE.
Fixes #12616.
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>