Security fix: prevent path traversal in SendOauth2

[wanamirulhakim]

This PR fixes two path traversal vulnerabilities identified recently.

Issue 1: mailAuthSet path traversal

mailAuthSet was previously passed directly into SendOauth2B and SendOauth2D and later used in filesystem operations.
This allowed directory traversal (e.g. ../) and arbitrary file read/write.

Fix:

• Added strict allowlist validation (alphanumeric only) for mailAuthSet
• Invalid values now throw an exception early

Issue 2: gmailXoauth2Credentials file write traversal

gmailXoauth2Credentials was used directly as a filename in file_put_contents(), allowing arbitrary file overwrite.

Fix:

• Wrapped the filename with basename() to prevent directory traversal

Verification

• Tested with inputs like ../evil
• Before: files could be written outside intended directory
• After: input is rejected or safely constrained

These fixes apply validation at the core classes so all wrappers are protected consistently.