Hardening: Remove dangerous characters + Subdirectory Check

If an user is able to create folders in /core/l10n/ he is able to include arbitrary PHP files with today's logic. 

Therefore I've added an `issubdirectory` check and removed all potential dangerous characters from `$lang`.

I think this may be useful to backport as we had recently an issue where users on IIS could create arbitrary folders.