SQL injection in /management/tables/{tableName}/data via orderAscendingColumn/orderDescendingColumn

## Summary

Flowable's management/tables REST endpoint (`GET/POST {root}/management/tables/{tableName}/data`) concatenates the `orderAscendingColumn` and `orderDescendingColumn` request parameters directly into the SQL `ORDER BY` clause without validation or parameter binding (`order by ${order}`). An authenticated (or, depending on deployment, unauthenticated) caller can inject arbitrary SQL expressions, with error responses echoing the fully rendered statement back to the client — enabling error-based/blind data extraction and potentially destructive statements depending on the JDBC driver's statement allowances.

## Affected versions

Verified end-to-end on a current Flowable release (live lab reproduction); source-confirmed on current `main`. The endpoint ships with the standard `flowable-rest` application.

## Proof of Concept (verified on an isolated lab host)

```
# Boolean differential via CASE WHEN
GET /management/tables/ACT_GE_PROPERTY/data?orderAscendingColumn=(CASE WHEN (1=1) THEN 1 ELSE 1 END)
→ HTTP 200

GET /management/tables/ACT_GE_PROPERTY/data?orderAscendingColumn=(CASE WHEN (1=0) THEN CAST(1/0 AS INT) ELSE 1 END)
→ HTTP 500, error body echoes the fully concatenated "order by CASE WHEN ..." statement (TableData.xml)

# Unauthenticated access is rejected with 401 (boundary confirmed)
```

## Suggested fixes

Validate the order-column parameters against the table's known column names (allow-list) or bind ordering through the persistence layer's identifier quoting; never interpolate request parameters into SQL text.

## Coordinated disclosure

We will keep details private until a fix is available (happy to align with your release schedule) and ask for coordinated disclosure of up to 90 days. We found no public advisory or issue covering this injection point.

Trace the management tables data entry point in the flowable-rest application and inspect TableData.xml on main, starting with orderAscendingColumn and orderDescendingColumn handling. Reproduce the supplied CASE WHEN requests and compare behavior for known table columns. Done means these parameters are validated or safely quoted and injected SQL is no longer accepted.

Written by the indexing model from the issue text.