fix(common): harden CORS, sort, raw-SQL WHERE and x-custom-sql-or

Add a `hardening` config section (RESOLVESPEC_HARDENING_*) so each
fix can be switched off to restore the previous behaviour:

- cors_strict_origins: only reflect origins listed in
  cors.allowed_origins / server URLs, with credentials; `*` never
  sends credentials; fix shared-slice append of expose headers.
- sort_strict: join aliases must match `alias.identifier` (empty alias
  no longer matches everything); sort expressions reject dangerous
  functions/catalogs; cql* columns must be identifier-safe.
- sql_strict: client raw-SQL fragments must have balanced parens and
  quotes, no comments/`;`/`$$`, DML keywords, dangerous functions or
  system catalogs; a rejected fragment now fails closed ("(1=0)")
  instead of dropping the filter. Subqueries stay allowed unless
  sql_block_subqueries is set.
- x-custom-sql-or is grouped together with the client's own
  conditions (new optional WhereGrouper, implemented for bun and gorm)
  so it can no longer OR past server-side filters.

pkg/common/validation_test.go

@@ -435,19 +435,19 @@ func TestFilterRequestOptions_WithSortExpressions(t *testing.T) {
 
 	options := RequestOptions{
 		Sort: []SortOption{
-			{Column: "id", Direction: "ASC"},                                    // Valid column
-			{Column: "(SELECT MAX(age) FROM users)", Direction: "DESC"},         // Safe expression
-			{Column: "name", Direction: "ASC"},                                  // Valid column
-			{Column: "(id); DROP TABLE users; --", Direction: "DESC"},          // Dangerous expression
-			{Column: "invalid_col", Direction: "ASC"},                           // Invalid column
+			{Column: "id", Direction: "ASC"},                                     // Valid column
+			{Column: "(SELECT MAX(age) FROM users)", Direction: "DESC"},          // Safe expression
+			{Column: "name", Direction: "ASC"},                                   // Valid column
+			{Column: "(id); DROP TABLE users; --", Direction: "DESC"},            // Dangerous expression
+			{Column: "invalid_col", Direction: "ASC"},                            // Invalid column
 			{Column: "(CASE WHEN age > 18 THEN 1 ELSE 0 END)", Direction: "ASC"}, // Safe expression
 		},
 	}
 
 	filtered := validator.FilterRequestOptions(options)
 
-	// Should keep: id, safe expression, name, another safe expression
-	// Should remove: dangerous expression, invalid column
+	// Keeps: id, subquery expression, name, CASE expression
+	// Removes: dangerous expression, invalid column
 	expectedCount := 4
 	if len(filtered.Sort) != expectedCount {
 		t.Errorf("Expected %d sort options, got %d", expectedCount, len(filtered.Sort))
@@ -474,8 +474,8 @@ type RelatedModel struct {
 // PreloadParentModel has a has-one relation to RelatedModel. The json tag on
 // the relation field is the name used in x-preload headers.
 type PreloadParentModel struct {
-	ID      int64        `bun:"id,pk"`
-	Name    string       `bun:"name"`
+	ID      int64         `bun:"id,pk"`
+	Name    string        `bun:"name"`
 	RELATED *RelatedModel `json:"RELATED" bun:"rel:has-one,join:id=related_id"`
 }