fix(webconsole): remediate security risk summary vulnerabilities

[lianziqt]

Addresses the five issues in docs/soc_risk_summary.md:

1. FilesApi directory traversal: canonicalize the requested directory via realpath + commonpath and reject any path that escapes STORAGE_ROOT.
2. Missing @jwt_required on DatasetPreviewApi and DatasetMetricsApi.
3. DatasetsApi cross-tenant listing (IDOR): require an explicit and existing project id before returning any datasets.
4. Workflow variables PodSpec injection: JSON-escape user-provided STRING variables when they are interpolated into a job yaml template so they cannot break out of the enclosing string and inject PodSpec fields.
5. GRPC_SSL_SERVER_HOST nginx annotation CRLF/config injection: validate the value against a strict FQDN charset on both project create and update paths.
6. sparkapps name path traversal: enforce a DNS-label allowlist for the sparkapp name and re-check with realpath + commonpath that the resulting upload path stays inside self._base_dir; guard the clear-and-recreate operation the same way.
7. DEBUG env var JWT bypass: parse DEBUG as a strict boolean so values like the string "False" no longer disable auth; additionally require FLASK_ENV != production before honoring the debug bypass in jwt_required.