Refactor extract cache key sanitization into dedicated package

What does this MR do?

Moves the sanitizeCacheKey function out of shells/abstract.go into its own package at cache/cachekey. The function is renamed to cachekey.Sanitize and its tests are moved alongside it.

Why?

This functionality is easier to test in isolation, and I plan on reusing this functionality elsewhere, and couldn't do that with where it lives today.

What changed?

• New package cache/cachekey with Sanitize() and comprehensive tests.
• shells/abstract.go: removed sanitizeCacheKey and its associated helper closures. newCacheConfig now calls cachekey.Sanitize and handles the "key was modified" warning at the call site rather than receiving it as an error from the sanitizer.
• shells/abstract_test.go: removed TestSanitizeCacheKey, which is now covered by the new package's test file.

Implementation notes

• The strings.NewReplacer approach replaces three sequential strings.ReplaceAll calls with a single-pass replacer. The replacement patterns do not overlap, so the output is identical.
• path.Clean("/" + x) is equivalent to path.Join("/", x) since Join calls Clean internally.
• The hasher/sanitizer selection in newCacheConfig is simplified from a map[bool] lookup to a plain if block.

What's the best way to test this MR?

Pipeline tests should be adequate. I confirmed that the old tests and new tests passed with the old implementation and the new implementation.

What are the relevant issue numbers?