Restrict project ID parameters for GAR setup scripts

These scripts currently allow any string parameters, but they are
expecting a Google Project ID. We should restrict these parameters so
that shell special characters cannot be passed into the scripts through
URL parameters.

Changelog: fixed
EE: true