Sanitise capsule and repository names.

Before this commit, one could craft a capsule and get hgc-deploy to
run it, which gave all manner of root exploits.