Fix missing filename sanitization on V2 JSON character import + harden getPngName as safety nee (#5538)

* fix: sanitize character filenames on V2 JSON import and harden getPngName

- Add missing sanitize() call in importFromJson V2 spec branch to match all other import paths
- Sanitize data.name before readFromV2() so the name field sync happens automatically
- Add sanitize() as defense-in-depth inside getPngName() to catch future oversights
- Refactor getPngName() to use getUniqueName() utility for consistent name generation

* fix: sanitize data.name before readFromV2 in importFromPng and importFromCharX

Same bug as importFromJson: readFromV2() overwrites the top-level name
with the unsanitized data.name, undoing any prior sanitize() call.
Fix by sanitizing data.name before readFromV2 so the sync preserves it.

* fix: sanitize top-level name field in JSON and CharX import paths

* fix: incorrect path rejection in isPathUnderParent

* fix: increase maxTries in getPngName

---------

Co-authored-by: Cohee <18619528+Cohee1207@users.noreply.github.com>