Prevent path traversal through replay IDs.

Replay flushing interpolated contexts.replay.replay_id from the stored
crash event into JSON and MP4 paths after only checking for a nonempty
string. A crafted ID containing path separators and parent-directory
components could select files outside the replay staging directory.
Matching JSON/MP4 files could be read, the video uploaded to the
configured DSN, and both files deleted.

Require a complete 32-digit hexadecimal UUID or its standard hyphenated
form before constructing either path. Preserve casing and hyphenation
to keep matching staged filenames. The existing UUID parser is
unsuitable for validation because it accepts partial IDs and ignores
trailing input once it has decoded 16 bytes.

The related videoFilename issue allowed an on-disk JSON sidecar to
redirect video uploads to arbitrary readable files using absolute paths
or traversal components. Current code already derives video filenames
from replay_id; document that videoFilename is ignored.

Add UUID unit coverage for valid forms, invalid lengths and characters,
misplaced hyphens, embedded NULs, and trailing data.