Match filename and username exactly

To avoid issues like:
jlord/patchwork#40383

Caused by this PR:
jlord/patchwork#40183

And leading to exploitation of the bug via:
jlord/patchwork#40478

merge.js

@@ -94,7 +94,7 @@ module.exports = function (pullreq, callback) {
 
   function verifyFilename (prInfo) {
     var filename = prInfo.filename.toLowerCase()
-    if (filename.match('contributors/add-' + stats.user.toLowerCase())) {
+    if (filename.match(new RegExp('^contributors/add-' + stats.user.toLowerCase() + '.txt$'))) {
       console.log(new Date(), 'PR ', stats.prNum, 'Filename: MATCH ', stats.user)
       return verifyContent(prInfo)
     } else {