This commit adds a strict validation regex (^[a-zA-Z0-9_-.]+$) and explicit .. checks for app_name, eval_set_id, eval_case_id, and eval_set_result_id in LocalEvalSetsManager and LocalEvalSetResultsManager. By sanitizing path parameters, this prevents directory traversal attacks when the FastAPI endpoints attempt to read or modify evaluation JSON files on the local filesystem.

Problem:
The LocalEvalSetsManager and LocalEvalSetResultsManager classes inside src/google/adk/evaluation/ were missing input sanitization for various path routing IDs (app_name, eval_set_id, eval_case_id, and eval_set_result_id). Because these values were blindly passed into os.path.join() when executing operations via adk web endpoints (like GET /apps/{app_name}/eval-sets/{eval_set_id}...), an attacker could craft malicious directory traversal patterns (e.g., ../..) allowing them to traverse out of the target evaluation directory. This introduces a vulnerability where unauthorized users could read or delete sensitive evaluation records (.evalset.json / .evalset_result.json files) belonging to other applications on the server's filesystem.

Solution:
A new _validate_id() logic enforcement was introduced across the board in LocalEvalSetsManager and LocalEvalSetResultsManager. This restricts parameters using a rigid regex pattern (^[a-zA-Z0-9_\-\.]+$) that allows necessary characters like hyphens and floating-point timestamps (which are natively appended to result IDs), but explicitly rejects payloads containing double dots (..). This ensures the adk web router endpoints can strictly read, update, or delete payloads within their expected hierarchical folder paths, permanently patching the unauthenticated scope leakage risk.