fix(panel): validate sponsor logo name before any file or network use

The public /sponsors/logo/:name route only accepted names matching an
active sponsor's logo, which was already regex-filtered, but that guard
was indirect. Checking sponsorLogoRe on the name itself makes the
path/URL safety local and clears CodeQL alerts #113 (go/request-forgery)
and #114 (go/path-injection).

internal/web/service/panel/sponsor.go

@@ -110,6 +110,10 @@ func cachedSponsors() (*SponsorList, error) {
 
 // GetSponsorLogo returns the image bytes for a logo of a currently active sponsor.
 func (s *PanelService) GetSponsorLogo(name string) ([]byte, string, error) {
+	// Validated here, not only via list membership, so name can never carry a path or URL.
+	if !sponsorLogoRe.MatchString(name) {
+		return nil, "", ErrSponsorLogoUnknown
+	}
 	sponsors, err := s.GetSponsors()
 	if err != nil {
 		return nil, "", err