feat: variables in template file names

[vesse]

Render variables to template file names too

[majori]

We should add a validator and a test to check what happens if variable tries to escape the file from project directory. For example if the README_FILE_NAME variable equals ../../foo/bar.

We can not allow files being generated/overwritten outside of the project context.

[majori]

We could also add a failsafe to the saver function to make sure that the file does not try to escape dest.

[vesse]

Added validation to saver. Should I still add check also for the interactive part or just consider passing invalid file name as a user being wiseass on purpose and it's OK to just fail during save? Validating the input would require quite a lot of context since just having .. in the value does not mean the output would escape the project folder since the template named file can be in deep folder structure.

[majori]

Yeah I think it is fine to validate it only when saving. The validation is mainly meant for the user to protect from malicious recipe which tries to override /etc/passwd or similar