Allowlist input sanitization

Implement allowlist-based input sanitization. Given a value string and an allowlist (a list of permitted characters), return a new string containing only the characters of value that appear in the allowlist, preserving their original order. Characters not on the allowlist are dropped entirely. This is the safe alternative to denylisting dangerous characters.