fix(appsettings): the theme must be one of the themes in SASS_DIR

The settings page took the posted theme name as it came and wrote it
into the @import lines of wvc-main.scss and the compiled CSS: a name
with "../" or a quote imported files outside the themes directory
(CodeQL py/path-injection; the page is for superusers).

The name must now be one of the directories in SASS_DIR/wvc-themes, the
list the page already offers; anything else is refused with a message
and nothing is written. themes_list is empty when SASS_DIR has no
themes, so every name is refused then.

Checked with the real dev/scss: flatly is applied and compiled as
before, "../../etc" is refused and leaves the CSS alone. The test fails
on the previous code.

appsettings/test_theme_name.py

@@ -0,0 +1,27 @@
+"""The theme name posted on the settings page must be one of the themes in
+SASS_DIR/wvc-themes: it is written into @import paths and the compiled CSS."""
+
+import os
+import tempfile
+
+from appsettings.models import AppSettings
+from django.contrib.auth.models import User
+from django.test import TestCase
+from django.urls import reverse
+
+
+class ThemeNameTests(TestCase):
+    def setUp(self):
+        self.client.force_login(User.objects.create_superuser("th-admin", "th@example.com", "pw"))
+        self.sass = tempfile.TemporaryDirectory()
+        self.addCleanup(self.sass.cleanup)
+        os.makedirs(os.path.join(self.sass.name, "wvc-themes", "flatly"))
+        AppSettings.objects.filter(key="SASS_DIR").update(value=self.sass.name)
+        self.before = AppSettings.objects.get(key="BOOTSTRAP_THEME").value
+
+    def test_a_name_that_is_not_a_theme_is_refused(self):
+        for theme in ("../../etc", "flatly';@import '/etc/passwd", "nope", ""):
+            with self.subTest(theme=theme):
+                self.client.post(reverse("appsettings"), {"BOOTSTRAP_THEME": theme})
+                self.assertFalse(os.path.exists(os.path.join(self.sass.name, "wvc-main.scss")))
+                self.assertEqual(AppSettings.objects.get(key="BOOTSTRAP_THEME").value, self.before)