fix: Add new entry to FORBIDDEN_USERNAMES_REGEXPS (#582)

Ensure people cannot hijack CLI install paths - see
https://docs.apify.com/cli/docs/next/installation

Author: jancurn

packages/utilities/src/utilities.ts

@@ -241,9 +241,12 @@ const FORBIDDEN_USERNAMES_REGEXPS = [
     // All hidden files
     '(\\..*)',
 
-    // File starting with xxx-
+    // Username starting with xxx-
     '(xxx-.*)',
 
+    // Username starting with install-cli. (see https://docs.apify.com/cli/docs/installation)
+    '(install-cli\\..*)',
+
     // Strings not starting with letter or number
     '([^0-9a-z].*)',