Add more clarity Query builder doc strings (#19640)

* Add more clarity Query builder doc strings

Be more clear about which methods are not safe to be used with
user-controlled data.

Thanks to Feei for reporting these gaps via our security process.

---------

Co-authored-by: othercorey <corey.taylor.fl@gmail.com>

Remove explicit schema in postgreschema (#19606)

Remove the hardcoded `public` schema from postgis column reflection.
Adding a test seemed more complex than it would provide value.

Fixes #19604

Document driver-specific function transforms (#19566)

Update version constraints and branch aliases

Update split package version constraints and branch aliases to 5.5

Fix weakness in FunctionsBuilder::jsonValue() with postgres (#19530)

The postgres driver needs to transforms jsonValue function calls to
rename the function and apply postgres specific cast operations. If the
current implementation is provided a user-controlled path expression,
the generated query can be manipulated.

Thanks to Himanshu Anand for reporting this

Fix weakness in FunctionsBuilder::jsonValue() with postgres (#19530)

The postgres driver needs to transforms jsonValue function calls to
rename the function and apply postgres specific cast operations. If the
current implementation is provided a user-controlled path expression,
the generated query can be manipulated.

Thanks to Himanshu Anand for reporting this

4.x - Fix parameter handling in FunctionsBuilder (#19520) (#19528)

Fix parameter handling in FunctionsBuilder (#19520)

Fix weakness in FunctionsBuilder

Several methods did not explicity label their parameters as unsafe, so
it is possible for an application developer to mistakenly supply user
controlled data into these parameters creating a SQL injection vector.

Thank you to Himanshu Anand for reporting this issue.

Backport #19520 to 4.x

Fix parameter handling in FunctionsBuilder (#19520)

Fix weakness in FunctionsBuilder

Several methods did not explicity label their parameters as unsafe, so
it is possible for an application developer to mistakenly supply user
controlled data into these parameters creating a SQL injection vector.

Thank you to Himanshu Anand for reporting this issue.

Fix parameter handling in FunctionsBuilder (#19520)

Fix weakness in FunctionsBuilder

Several methods did not explicity label their parameters as unsafe, so
it is possible for an application developer to mistakenly supply user
controlled data into these parameters creating a SQL injection vector.

Thank you to Himanshu Anand for reporting this issue.

Fix parameter handling in FunctionsBuilder (#19520)

Fix weakness in FunctionsBuilder

Several methods did not explicity label their parameters as unsafe, so
it is possible for an application developer to mistakenly supply user
controlled data into these parameters creating a SQL injection vector.

Thank you to Himanshu Anand for reporting this issue.