TMSS-2829: use regex for destination path validation to prevent bash injection

SAS/TMSS/backend/src/tmss/tmssapp/schemas/subtask_template/copy/copy_pipeline-1.json

@@ -14,7 +14,8 @@
       "destination": {
         "default": "localhost:/tmp",
         "description": "Where to copy the data to: <host>:/path/to/destination",
-        "type": "string"
+        "type": "string",
+        "pattern": "^[a-zA-Z\\d_\\-]*\\:?(/[a-zA-Z\\d_\\-]+)+$"
       },
       "managed_output": {
         "default": false,

SAS/TMSS/backend/src/tmss/tmssapp/schemas/task_template/pipeline/copy_pipeline-1.json

@@ -14,7 +14,8 @@
       "destination": {
         "default": "localhost:/tmp",
         "description": "Where to copy the data to: <host>:/path/to/destination",
-        "type": "string"
+        "type": "string",
+        "pattern": "^[a-zA-Z\\d_\\-]*\\:?(/[a-zA-Z\\d_\\-]+)+$"
       },
       "managed_output": {
         "default": false,