Potential fix for code scanning alert no. 36: Uncontrolled data used in path expression

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

Author: PaulDalek

lib/server/routes/change_hc_version.js

@@ -51,7 +51,11 @@ export default (app) =>
 
             // Compare versions
             const newVersion = request.params.newVersion;
-            if (newVersion) {
+            // Accept only version strings containing digits, letters, dots, hyphens
+            if (
+              newVersion &&
+              /^[a-zA-Z0-9.\-]+$/.test(newVersion)
+            ) {
               try {
                 // eslint-disable-next-line import/no-named-as-default-member
                 await updateVersion(newVersion);