Potential fix for code scanning alert no. 2: Server-side request forgery

[jdfalk]

Potential fix for https://github.com/VisualDx/visualdx-api-diagnosis-proxy/security/code-scanning/2

To mitigate SSRF risks, we must validate or restrict the user-supplied path segment (diagnosisId, and possibly also viewId) before using them to construct an internal API URL. The best general fix is to allow only expected, safe formats for these values—such as using a regex to ensure they're strictly alphanumeric (plus optionally dashes/underscores if needed) and do not contain slashes, dots, or other unsafe characters.

Specifically, in pages/api/diagnoses/[diagnosisId]/[viewId].js:

• Before constructing apiUrl, validate that diagnosisId (and optionally viewId) match a strict regular expression (e.g., /^[a-zA-Z0-9_-]+$/).
• If validation fails, respond with HTTP 400 and an error message, without making any API calls.
• This change should be placed right after the extraction of diagnosisId and viewId and before they are used.

No new methods or imports are needed beyond what’s already present.

---

Suggested fixes powered by Copilot Autofix. Review carefully before merging.