fix(log-drain): prevent command injection by base64-encoding environment variables

Replace direct shell interpolation of environment values with base64 encoding
to prevent command injection attacks. Environment configuration is now built as
a single string, base64-encoded, then decoded to file atomically.

Also add regex validation to restrict environment field values to safe
characters (alphanumeric, underscore, hyphen, dot) at the application layer.

Fixes GHSA-3xm2-hqg8-4m2p

app/Livewire/Server/LogDrains.php

@@ -24,16 +24,16 @@ class LogDrains extends Component
     #[Validate(['boolean'])]
     public bool $isLogDrainAxiomEnabled = false;
 
-    #[Validate(['string', 'nullable'])]
+    #[Validate(['string', 'nullable', 'regex:/^[a-zA-Z0-9_\-\.]+$/'])]
     public ?string $logDrainNewRelicLicenseKey = null;
 
     #[Validate(['url', 'nullable'])]
     public ?string $logDrainNewRelicBaseUri = null;
 
-    #[Validate(['string', 'nullable'])]
+    #[Validate(['string', 'nullable', 'regex:/^[a-zA-Z0-9_\-\.]+$/'])]
     public ?string $logDrainAxiomDatasetName = null;
 
-    #[Validate(['string', 'nullable'])]
+    #[Validate(['string', 'nullable', 'regex:/^[a-zA-Z0-9_\-\.]+$/'])]
     public ?string $logDrainAxiomApiKey = null;
 
     #[Validate(['string', 'nullable'])]
@@ -127,7 +127,7 @@ class LogDrains extends Component
         if ($this->isLogDrainNewRelicEnabled) {
             try {
                 $this->validate([
-                    'logDrainNewRelicLicenseKey' => ['required'],
+                    'logDrainNewRelicLicenseKey' => ['required', 'regex:/^[a-zA-Z0-9_\-\.]+$/'],
                     'logDrainNewRelicBaseUri' => ['required', 'url'],
                 ]);
             } catch (\Throwable $e) {
@@ -138,8 +138,8 @@ class LogDrains extends Component
         } elseif ($this->isLogDrainAxiomEnabled) {
             try {
                 $this->validate([
-                    'logDrainAxiomDatasetName' => ['required'],
-                    'logDrainAxiomApiKey' => ['required'],
+                    'logDrainAxiomDatasetName' => ['required', 'regex:/^[a-zA-Z0-9_\-\.]+$/'],
+                    'logDrainAxiomApiKey' => ['required', 'regex:/^[a-zA-Z0-9_\-\.]+$/'],
                 ]);
             } catch (\Throwable $e) {
                 $this->isLogDrainAxiomEnabled = false;