Fix the release path guard in a deploy script

An assistant's deploy script ran rm -rf on a release folder whose path it built from two environment variables, APP_NAME and BUILD_ID. On a host where one was not set, bash read it as an empty string, and the script wiped the wrong folder. Now the path comes from a guard that refuses anything unsafe.

An assistant wrote safe_release_target(app_name, build_id). It is in the editor. It has a bug. Find it and fix it.

Input and output:

• app_name: the value of APP_NAME. It can be any string, and it is empty when the variable was not set.
• build_id: the value of BUILD_ID, in the same way.
• Return the release folder as a string, or "" to refuse. An empty result means the cleanup must not run.

Rules the tests check:

• Check app_name and build_id the same way. A value is safe only when all of these hold:
  • It is not empty.
  • Every character is an ASCII letter (either case), a digit 0 to 9, ., - or _. Anything else, such as a space, /, * or $, makes it unsafe.
  • It does not start with ..
  • It does not contain .. anywhere.
• If either value is unsafe, return "".
• Otherwise return /var/www/, then app_name, then /releases/, then build_id, with nothing else added.