Invalidate username starging with ?. Fix #7205.

This fixes the issue minimally, but what I would really like to do is:

    /\A(?>!\.git\z)[.]?[a-zA-Z0-9_][a-zA-Z0-9_.-]*\z/

Which would allow usernames that end in `.git`, except `.git` exactly. Denying extension feels like an unnecessary restriction. I wish we had used:

    /\A[a-zA-Z][a-zA-Z0-9-]*\z/

from day one =( like GitHub, but now would be data destructive.