fix(datasets): accept BigTIFF headers and sanitise object keys

F1: ValidateFileContent rejected the pipeline's own output. GDAL writes a
BigTIFF header ("II+\0" / "MM\0+") whenever BIGTIFF=IF_SAFER kicks in for a
large raster, so accept both alongside the classic TIFF magic and reword the
error to "file is not a valid TIFF/BigTIFF GeoTIFF". GodalIO.Create now
delegates to an unexported createGTiff so a test can force BIGTIFF=YES and
assert the produced header passes the check.

F3: a user-supplied filename went straight into the S3 object key for dataset
uploads and for both dataset and dataset-group SLD uploads, so "../../x.sld"
escaped the dataset's own prefix. Reduce every such name to its base with a
shared safeObjectName helper, rejecting names with no usable base.

F9: rename the shadowing inner "raw" in the PATCH dg_id case to "s".

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

internal/transport/http/dataset_handler.go

@@ -481,13 +481,13 @@ func (h *DatasetHandler) patch(w http.ResponseWriter, r *http.Request) {
 			}
 			in.Unit, in.UnitSet = unit, true
 		case "dg_id":
-			raw, err := decodeOptionalPatchString(val)
+			s, err := decodeOptionalPatchString(val)
 			if err != nil {
 				httputil.WriteError(w, http.StatusUnprocessableEntity, "dg_id must be a valid UUID or null")
 				return
 			}
-			if raw != nil {
-				gid, err := uuid.Parse(*raw)
+			if s != nil {
+				gid, err := uuid.Parse(*s)
 				if err != nil {
 					httputil.WriteError(w, http.StatusUnprocessableEntity, "dg_id must be a valid UUID or null")
 					return