Invalidate username starting with ?. Fix #7205.

Fix #7205

This fixes the issue minimally, but what I would really like to do is:

    /\A(?!(\.git|\.|\.\.)\z)[.]?[a-zA-Z0-9_][a-zA-Z0-9_.-]*\z/

Which would also allow:

- usernames that end in `.git`, except `.git` exactly. Denying extension feels like an unnecessary restriction.
- `.`, `-` and `_` to be used anywhere, execpt for `.` and `..` exactly. The validation would be simpler for humans to understand, and ugly usernames are already possible like `._` so it does not matter much.

I wish we had used:

    /\A[a-zA-Z][a-zA-Z0-9-]*\z/

from day one like GitHub, but now would be data destructive =(