fix(datasets): accept BigTIFF headers and sanitise object keys

F1: ValidateFileContent rejected the pipeline's own output. GDAL writes a
BigTIFF header ("II+\0" / "MM\0+") whenever BIGTIFF=IF_SAFER kicks in for a
large raster, so accept both alongside the classic TIFF magic and reword the
error to "file is not a valid TIFF/BigTIFF GeoTIFF". GodalIO.Create now
delegates to an unexported createGTiff so a test can force BIGTIFF=YES and
assert the produced header passes the check.

F3: a user-supplied filename went straight into the S3 object key for dataset
uploads and for both dataset and dataset-group SLD uploads, so "../../x.sld"
escaped the dataset's own prefix. Reduce every such name to its base with a
shared safeObjectName helper, rejecting names with no usable base.

F9: rename the shadowing inner "raw" in the PATCH dg_id case to "s".

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

internal/domain/dataset_test.go

@@ -30,7 +30,10 @@ func TestValidateFileContent(t *testing.T) {
 	}{
 		{"valid tiff LE", ".tif", []byte("II*\x00rest"), true},
 		{"valid tiff BE", ".tiff", []byte("MM\x00*rest"), true},
+		{"valid bigtiff LE", ".tif", []byte("II+\x00rest"), true},
+		{"valid bigtiff BE", ".tiff", []byte("MM\x00+rest"), true},
 		{"bad tiff", ".tif", []byte("not a tiff"), false},
+		{"bad tiff near-miss prefix", ".tif", []byte("II-\x00rest"), false},
 		{"valid zip", ".zip", []byte("PK\x03\x04rest"), true},
 		{"bad zip", ".zip", []byte("RARrest"), false},
 		{"valid gpkg", ".gpkg", []byte("SQLite format 3\x00rest"), true},