level-name in server.properties not being input sanitized

Expected behavior

users not being able to set

level-name=

and it leading to creation of a world with empty string as a name, leading to plugin errors, because there was an assumption that world name is not an empty string.

Observed/Actual behavior

level-name=

results in creation of the world in the server root directory.

level-name=../

will attempt to create the world in the parent directory and

level-name=/home/someuser/world

will create it on the absolute path

all cases are likely to break plugin configs relying on the world name

Steps/models to reproduce

1. start a clean server
2. set level-name= in server-properties
3. see all the world files dumped in the server root directory

Plugin and Datapack List

n/a

Paper version

26.1.2-x (present in vanilla, bug report)

Other

No response

Start by reproducing the issue with the documented server.properties values, then trace how level-name is read and passed into world creation. Check the existing validation and world-path handling; done means empty, parent-directory, and absolute-path values are handled safely without creating worlds under unintended locations, with regression coverage for the reported cases.