Fix command injection in low security level

[r1kka6]

Summary

• validate the low security command injection target as an IPv4 address before invoking ping
• return the existing invalid-IP error for shell metacharacters and malformed input

Verification

• docker run --rm -v "$PWD:/work" -w /work php:8.3-cli php -l vulnerabilities/exec/source/low.php
• source-level probe: 127.0.0.1; printf OWNED returns ERROR: You have entered an invalid IP. while the baseline emits OWNED
• built dvwa-ctf-command-injection-low and verified the HTTP route rejects the payload but still pings 127.0.0.1