Validate command injection level 1 IP input

[r1kka6]

Summary

• require Level 1 ipaddress values to match the existing IPv4/localhost validator
• prevent shell metacharacters from reaching the ping command string
• keep valid 127.0.0.1 and localhost requests behaving as before

Verification

• ./gradlew compileJava test spotlessJavaCheck bootJar --no-daemon passed in an eclipse-temurin:17-jdk container
• vulnerable baseline returns CTF_MARKER for ipaddress=127.0.0.1; echo CTF_MARKER
• patched runtime returns empty content for that payload while valid 127.0.0.1 and localhost still reach the ping path