docs(dev): allowlist user-supplied columns and sort orders in database.rst - #15709

Summary

database.rst showed createNamedParameter() for values but not that column names and sort directions cannot be bound as parameters.

• Add a short section after the opening query example: allowlist user-supplied columns / sort orders before orderBy() / select().
• Include a small PHP match example mapping request input onto allowed identifiers.
• Note the same rule for Repository findBy() orderBy keys.

Closes #15682

Test plan

• Sphinx build of the developer manual succeeds for the database page
• New Allowlisting user-supplied columns and sort orders section appears before Transactions
• Example uses match for column and sort direction allowlists
• Section mentions orderBy() / select() and Repository findBy()

AI disclosure

This PR was drafted with the help of AI coding assistants (Cursor agents / LLM-based tools), including the description. I am responsible for it and happy to rework anything that doesn't fit.

All commits carry an Assisted-by: Cursor:grok-4.7 trailer.