fix: reject control characters in docker.env values (Dockerfile injection) - #5700

Fixes #5656

Root cause

Dict-form docker.env entries were interpolated into the generated Dockerfile completely raw (ARG {{ key }}={{ value }} in base.j2), while sibling paths were already hardened:

• list-form env → regex-validated in _convert_env (build_config.py)
• system_packages → bash_quote
• base_image → normalize_line

A newline in a value terminates the ARG instruction — Dockerfile instructions are newline-delimited and quotes do not span lines, so any following lines execute as instructions at build time (reproduced offline via generate_containerfile; the reporter's exact payload renders a live RUN echo PWNED... step).

Fix (src/bentoml/_internal/bento/build_config.py, +45/-3)

1. Dict branch of _convert_env: keys/values are checked against a control-character class ([\x00-\x1f\x7f]) and raise BentoMLException with guidance to use the list form or an .env file for complex values. This is the single choke point every template renders from, so v1/v2/debian/alpine/ubi8 are all covered.
   • Plain values keep working byte-identically: spaces are legal unquoted on ARG KEY=value lines ({"GREETING": "hello world"} renders exactly as before).
2. BentoEnvSchema (the v2 envs: path): same guard added as attr validators on name/value. The issue notes this path as "hardened", but bash_quote only wraps in single quotes — a raw newline inside still breaks the instruction, so the guard is needed at definition time.

Tests (tests/unit/_internal/container/test_generate.py, +40 lines)

Following the existing same-family patterns (test_generate_containerfile_quotes_system_packages, ..._normalizes_custom_base_image):

• newline payload in dict env raises BentoMLException at DockerOptions construction (before any template rendering)
• legit values ("hello world", URL) render unchanged and no payload appears
• BentoEnvSchema rejects control chars in value and name, accepts legit entries

Red→green verified against the pre-fix tree: 5 passed → 8 passed (the 3 new tests fail without the fix; the reporter's repro script also flips from "Injection present: True" to raising at construction). ruff check/format --check: zero new findings vs. baseline on both touched files.