Patch with no query updates all records in the database

> While struggling to to learn how to write the correct query
> to patch only one record, I tried no query and the default of
> patch all records was performed.

## Steps to reproduce

1. Following the the todo-list [tutorial](https://loopback.io/doc/en/lb4/todo-list-tutorial.html)
```bash
lb4 example todo-list
cd loopback4-example-todo-list
npm start
```

2. Browse to the API explorer at http://127.0.0.1:3000

3. Notice that the database is prepopulated

a. With GET todo-lists/count
- Click `Try It out`
- remove the default query
- press the `execute` button
- see result `{ "count": 2 }`

b. With button GET todo-lists/
- Click `Try It out`
- remove the default query
- press the execute button
- see the response has two lists
```bash
[
{
"id": 1,
"title": "Sith lord's check list",
"color": "blue"
},
{
"id": 2,
"title": "My daily chores",
"color": "red"
}
]
```

c. Click button `GET /todo-lists/{id}/todos`
- Click `Try It out`
- Enter `1` for the id number of the first list
- remove the default query
- press the execute button
- see the response is quantity three pre-populated todos
id's 1, 2 and 4 .

__WARNING__: about to (accidentally) patch all the todos in the list!

d. Click button `PATCH /todo-lists/{id}/todos`
- Click `Try It out`
- Enter `1` for the id number of the first list
- remove the default query
- add some replacement data in the request body, for example:
```json
{
"id": 4,
"title": "my-title-string",
"desc": "a short description string",
"isComplete": false,
"todoListId": 1
}
```
- press the `execute` button
- see the response is
```bash
{
"count": 3
}
```

e. Re-perform step c. above to see the result is:
```json
[
{
"id": 1,
"title": "my-title-string",
"desc": "a short description string",
"isComplete": false,
"todoListId": 1
},
{
"id": 2,
"title": "my-title-string",
"desc": "a short description string",
"isComplete": false,
"todoListId": 1
},
{
"id": 4,
"title": "my-title-string",
"desc": "a short description string",
"isComplete": false,
"todoListId": 1
}
]
```
- an array where all the records have been unceremoniously patched to equal the replacement data! The list count is still { "count": 2 }.

## Current Behavior

* Default (accidental) patch of all records.

## Expected Behavior

* My expectation is that at least nothing would happen
accidentally. Even better, no patch-all would occur
and that a somewhat helpful error message would be
returned stating that an empty query is not allowed with
a patch request.

## Link to reproduction sandbox

__N/A__

## Additional information

- linux x64 14.15.1

@loopback/example-todo-list@3.7.1 /home/northdecoder/workspace/loopback4-example-todo-list
├── @loopback/boot@3.2.0
├── @loopback/core@2.14.0
├── @loopback/repository@3.4.0
├── @loopback/rest@9.1.2
├── @loopback/rest-explorer@3.0.6
├── @loopback/service-proxy@3.0.6
├── loopback-connector-rest@4.0.1

## Related Issues

Issue #
- Deletes all with no query issue# [7017](https://github.com/strongloop/loopback-next/issues/7017). Not sure the code is related, however the pattern of behavior is similar.

Start by reproducing the empty-query PATCH through the todo-list tutorial's API Explorer endpoint, then inspect the @loopback/repository and @loopback/rest packages involved in handling it. Compare the behavior with related issue #7017. Done means an empty query no longer patches every todo and the endpoint returns a helpful error or otherwise performs no update.

Written by the indexing model from the issue text.