Release security: make it impossible to clobber builddirs which have the "release prefix"

@djmitche I agree I need to rethink this situation. The clobber endpoint will very often (usually?) be used to create multiple clobber requests at once; but I don't know of a good way to indicate partial success or failure. I've been thinking of making /clobber only take one request at a time; with the tradeoff that we will be hitting the database more often. With so few users it shouldn't be a problem. I'll put out a patch for this.