feat(validation): add SQL structure security rules

[abdul-kaioum]

Description

Adds reusable validation rules for simple SQL identifiers and sort directions, with end-to-end coverage for malicious sort payloads, exact errors, nullable semantics, and first-failure behavior. It also restores PHP compatibility in the nested helper, documents the SQL security boundary, and adds a PHP 5.6 parse/rule-smoke CI gate.

Motivation & Context

Text sanitization does not make caller-controlled SQL structure safe. Consumers need explicit validation for single identifier segments and asc/desc, while database-layer allowlisting and typed identifier handling remain mandatory.

Type of Change

• New security validation feature
• Backward-compatible bug fix
• Tests and documentation
• CI hardening

Security Boundaries

• sql_identifier validates one unqualified identifier segment; it does not quote SQL.
• sort_direction validates asc or desc; it does not build an ORDER BY clause.
• sanitize:text and sanitize:key are not SQL-context controls.
• Consumers must still map public sort keys to known columns.

Verification

• 66 tests, 137 assertions on PHP 8.5
• PHPCompatibility passes all 37 source files
• PHP 5.6 container parses all source files and passes dependency-free rule smoke checks
• Workflow YAML and git diff --check pass
• Independent task reviews and final whole-branch review approved

Checklist

• Code follows project style and PHP compatibility requirements
• Self-review and independent code review completed
• Tests added and updated
• Documentation updated
• No raw SQL quoting or query construction added to the validator layer

Notes

The GitHub-hosted PHP 5.6 workflow has not yet run; local container parse/smoke verification passed. Existing Pest deprecation notices remain visible but do not fail the suite.