fix(datasets): accept BigTIFF headers and sanitise object keys

F1: ValidateFileContent rejected the pipeline's own output. GDAL writes a
BigTIFF header ("II+\0" / "MM\0+") whenever BIGTIFF=IF_SAFER kicks in for a
large raster, so accept both alongside the classic TIFF magic and reword the
error to "file is not a valid TIFF/BigTIFF GeoTIFF". GodalIO.Create now
delegates to an unexported createGTiff so a test can force BIGTIFF=YES and
assert the produced header passes the check.

F3: a user-supplied filename went straight into the S3 object key for dataset
uploads and for both dataset and dataset-group SLD uploads, so "../../x.sld"
escaped the dataset's own prefix. Reduce every such name to its base with a
shared safeObjectName helper, rejecting names with no usable base.

F9: rename the shadowing inner "raw" in the PATCH dg_id case to "s".

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

internal/raster/godal.go

@@ -66,10 +66,17 @@ func (r *godalReader) Close() error { return r.ds.Close() }
 type godalWriter struct{ ds *godal.Dataset }
 
 func (g *GodalIO) Create(_ context.Context, path string, grid Grid, o WriterOptions) (Writer, error) {
+	return createGTiff(path, grid, o, "IF_SAFER")
+}
+
+// createGTiff writes a tiled Int16 GeoTIFF. bigTIFF is the value of the
+// BIGTIFF creation option ("IF_SAFER" in production); it is a parameter so
+// tests can force a BigTIFF header.
+func createGTiff(path string, grid Grid, o WriterOptions, bigTIFF string) (Writer, error) {
 	tile := fmt.Sprint(o.TileSize)
 	ds, err := godal.Create(godal.GTiff, path, 1, godal.Int16, grid.Width, grid.Height,
 		godal.CreationOption("TILED=YES", "BLOCKXSIZE="+tile, "BLOCKYSIZE="+tile,
-			"COMPRESS="+o.Compression, "PREDICTOR=2", "BIGTIFF=IF_SAFER"))
+			"COMPRESS="+o.Compression, "PREDICTOR=2", "BIGTIFF="+bigTIFF))
 	if err != nil {
 		return nil, fmt.Errorf("create raster %s: %w", path, err)
 	}