`Arbitrary` instances for `InstallDirs` and `PathTemplate` create invalid filenames

**Describe the bug**
While they are used at multiple types, ultimately those bottom out to `Prelude`'s `FilePath` which is `String`. The result is that the pathnames they generate can contain `NUL`s, Windows device names, and illegal sequences (for example, on Windows a path component cannot end with a `.`).

Ideally we would use the new `filepath` library with its bespoke `FilePath` type, for which valid `Arbitrary` instances can be written and may even already exist. There is no way to make it work with `Prelude`'s `FilePath`.

There is more discussion in #9253 and #9254, and the latter adds a warning comment to the problematic instances.