fix: prevent SQL injection bypass in escapeIdentifiers and protectIdentifiers

[gr8man]

Description
This PR fixes a critical SQL injection bypass vulnerability within BaseConnection::escapeIdentifiers() and BaseConnection::protectIdentifiers().

Previously, the framework blindly bypassed identifier escaping if it encountered a parenthesis ( or a single quote ' (relying on strcspn and str_contains), assuming it was a valid SQL function or subquery. This allowed attackers to inject malformed SQL strings (e.g., COUNT(id) OR 1=1 or unbalanced parentheses) that evaded escaping entirely.

Changes made:

• Removed the unsafe str_contains and strcspn checks.
• Introduced a strict isSafeToBypassEscape() regex validation that ensures an identifier is either a valid balanced function call (with optional safe aliases) or a proper string literal before bypassing the escape logic.
• Updated database tests to verify that malformed and malicious SQL injections (e.g., trailing operators, unbalanced parentheses) are now correctly caught and safely escaped as standard identifiers.

Checklist:

• Securely signed commits
• Component(s) with PHPDoc blocks, only if necessary or adds value (without duplication)
• Unit testing, with >80% coverage
• User guide updated

[mergeable]

Hi there, gr8man! 👋

Thank you for sending this PR!

We expect the following in all Pull Requests (PRs).

• PRs must be sent to the appropriate branch
• All git commits must be GPG-signed
• Must follow our style guide
• Be commented in the PHP source file
• Be documented in the user guide
• Be unit tested
• Pass all checks in GitHub Actions

Important

We expect all code changes or bug-fixes to be accompanied by one or more tests added to our test suite to prove the code works.

If pull requests do not comply with the above, they will likely be closed. Since we are a team of volunteers, we don't have any more time to work
on the framework than you do. Please make it as painless for your contributions to be included as possible.

See https://github.com/codeigniter4/CodeIgniter4/blob/develop/contributing/pull_request.md

Sincerely, the mergeable bot 🤖