Function isValidPackageName

A package name Packagist would accept, so a hostile value cannot be smuggled into the URL.

Refuses rather than encodes: a name that needs escaping is not a package name.