#3210 fix(jsonfilter): validate column identifier before building selector

Adds allowlist validation for the JSON filter column in BuildEntSelectorFromJSONFilter, restricting it to a bare SQL identifier before it reaches the query builder. This mirrors the existing field-path validation so input safety no longer depends on every caller hardcoding the column.

Defense-in-depth hardening: the only current caller already sets the column to a known constant.

🤖 Posted by Maximus bot (Claude Code) on behalf of @migmartri