security fix against malicious code injection

[cardosource]

In the code, a string substitution occurs without validation, which allows malicious code injection through these parameters:

func (block *ExprBlock) ComputeExpr(window, le string) string {
    replacer := strings.NewReplacer("$window", window, "$le", le)
    return replacer.Replace(block.Expr)
}



func (block *ExprBlock) ComputeQuantile(window string, quantile float64) string {
    replacer := strings.NewReplacer("$window", window, "$quantile", fmt.Sprintf("%g", quantile))
    return replacer.Replace(block.Expr)
}

Implementing the appropriate security fixes to validate inputs in the ComputeExpr and ComputeQuantile functions, preventing PromQL injection via the window, le, and quantile parameters. Return an empty string in case of a violation.