fix(datasets): accept BigTIFF headers and sanitise object keys

F1: ValidateFileContent rejected the pipeline's own output. GDAL writes a
BigTIFF header ("II+\0" / "MM\0+") whenever BIGTIFF=IF_SAFER kicks in for a
large raster, so accept both alongside the classic TIFF magic and reword the
error to "file is not a valid TIFF/BigTIFF GeoTIFF". GodalIO.Create now
delegates to an unexported createGTiff so a test can force BIGTIFF=YES and
assert the produced header passes the check.

F3: a user-supplied filename went straight into the S3 object key for dataset
uploads and for both dataset and dataset-group SLD uploads, so "../../x.sld"
escaped the dataset's own prefix. Reduce every such name to its base with a
shared safeObjectName helper, rejecting names with no usable base.

F9: rename the shadowing inner "raw" in the PATCH dg_id case to "s".

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

internal/service/dataset_group.go

@@ -151,7 +151,11 @@ func (s *DatasetGroupService) UploadSLD(ctx context.Context, id uuid.UUID, in Up
 	}
 	content := io.MultiReader(bytes.NewReader(head), in.Reader)
 
-	key := path.Join("groups", g.ID.String(), "sld", in.Filename)
+	name, err := safeObjectName(in.Filename)
+	if err != nil {
+		return domain.DatasetGroup{}, err
+	}
+	key := path.Join("groups", g.ID.String(), "sld", name)
 	if err := s.store.Put(ctx, key, content, in.Size, in.ContentType); err != nil {
 		return domain.DatasetGroup{}, err
 	}