cras: hfp: Sanitize phone number in IncomingCall

Restrict phone number to 3GPP TS 27.007 alphabet
(0-9, +, *, #) to prevent AT command injection via
CRLF in D-Bus IncomingCall.

BUG=b:516697355
TEST=Verify with PoC

Change-Id: Iedbab65209b2f021c435ca7bb364eea85f074220
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/third_party/adhd/+/8010746
Tested-by: chromeos-cop-builder@chromeos-cop.iam.gserviceaccount.com <chromeos-cop-builder@chromeos-cop.iam.gserviceaccount.com>
Commit-Queue: Hsinyu Chao <hychao@chromium.org>
Reviewed-by: Jeremy Wu <jrwu@google.com>