Separate validating, tweaking, and sanitizing

Some validation functions only validated, while some would actually make a tweaked version and return it. This caused some issues where the function was called incorrectly (it returns the new value, which evaluates to True, but if the value is different this should be interpreted as a failed validation), see 9aeb50d6.

The value-returning functions are now prefixed by fix_ and have a purely-validating counterpart.

In addition, don't bother sanitizing document filenames for filesystem use, just make sure they aren't very long. Sanitize them when we actually write to disk (e.g. in convert.py).