[Task] v1 publishing list: add sort param and expand filter scope

Context

Surfaced by the Publishing Queue migration spike (#36039). The new Angular Publishing Queue portlet (#36040) needs GET /v1/publishing (com.dotcms.rest.api.v1.publishing.PublishingResource#listPublishingJobs, PublishingResource:187) to support two capabilities the prototype design assumes:

1. Three-state sort on Bundle and Status columns (asc → desc → unsorted). Today the list endpoint returns a fixed ordering and the helper doesn't parse a sort parameter, so the FE either has to sort client-side after fetching (which breaks pagination correctness) or accept the default order.

2. Extended filter scope for the global top-bar search ("Search bundles, content, or environments"). Today the filter query param matches bundle_id and bundle_name partial substring only. The design surface filters across bundle name, bundle id, every item name + item type, every environment name, and every endpoint name.

Proposed change

Add to GET /v1/publishing:

• sort query param — comma-separated list, e.g. sort=created:desc,status:asc. Allowed keys: bundle_id, bundle_name, status, created, modified. Default: created:desc to preserve current behavior.
• Extend filter to perform a SQL OR substring match across the new columns (item_name, item_type, environment_name, endpoint_name) in addition to the existing two. Behind a feature flag dotcms.publishing.filter.extended=true (default on for new installs, off by default for upgrades) so legacy clients keep their current behavior.

Acceptance criteria

• GET /v1/publishing?sort=created:desc returns rows ordered by created descending
• GET /v1/publishing?sort=status:asc,created:desc applies both keys in order
• Invalid sort key → 400 with { message }
• GET /v1/publishing?filter=acme matches any bundle whose name, id, asset name/type, env name, or endpoint name contains acme (case-insensitive)
• OpenAPI updated with the new params
• Existing integration tests pass; new tests cover sort + extended filter behavior

Source links

• Spike audit: #36039 (see the API audit comment)
• FE consumer: #36040
• Epic: #34734

Start at com.dotcms.rest.api.v1.publishing.PublishingResource#listPublishingJobs, identified as PublishingResource:187, and trace how the sort and filter query parameters reach the data query. Review the OpenAPI definition and existing integration tests, then verify the documented sort ordering, invalid-key response, extended case-insensitive filtering, feature-flag behavior, and new test coverage.