validate variable names in copyToGlobals debug handler

[sahvx655-wq]

Expression injection via unvalidated variable names in copyToGlobals

While reading through the debug handlers I noticed copyToGlobals drops the client-supplied dstVariableName straight into globals()['{dst_var_name}'] and forwards that to setExpression, and hands srcVariableName over as the value expression, with neither of them checked. Its sibling richInspectVariables already runs str.isidentifier over the name it evaluates, so the omission here stood out. A name such as x'] or __import__('os').system('id') or globals()['y closes the quoted string and injects an arbitrary expression that debugpy then evaluates in the debuggee frame; the forwarded setExpression payload showed the escaped quotes plainly once I logged it.

Left as is this lets a malformed or hostile debug request steer evaluation well beyond a variable copy. The change rejects any dstVariableName/srcVariableName that is not a valid identifier before the expression is built, mirroring the guard the sibling handler already applies. Added a regression under the existing debugger tests that confirms such a request is refused locally rather than forwarded.