fix(core): validate username / gist id against the safe-character pattern

[marcalexiei]

• Related to fix warnings #342

stats and pin already reject username/repo/owner that don't match safePattern (/^[-\w/.,]+$/), but top-langs, wakatime, and gist didn't.

This applies the same guard:

• top-langs + wakatime: reject a username containing unsafe characters.
  Matters most for wakatime, where username is interpolated into the outbound request URL path.
• gist: same guard on its id param.

All three return the existing error - permanent card before any fetch.

Additional change

Simplified the layout / stats_format checks in top-langs:
dropped the redundant typeof x !== "string" || (a non-string already fails .includes(...)),
keeping the x !== undefined guard so the params stay optional.

[vercel]

@marcalexiei is attempting to deploy a commit to the martin-mfg's projects Team on Vercel.

A member of the Team first needs to authorize it.