Security hardening: SQL injection prevention, API key memory clearing, WHERE clause fix

[Copilot]

The plugin had several security vulnerabilities from unsanitized user inputs being embedded directly into SQL strings, plus a logic bug in the spatial extent filter that produced invalid SQL.

Changes

SQL injection prevention

• Added validate_identifier() in layer_utils.py — validates SQL identifiers against ^[A-Za-z_][A-Za-z0-9_]*(\.[A-Za-z_][A-Za-z0-9_]*)*$ before any embedding. Error messages never echo back user input.
• Applied at all injection points: geometry column name (extent filter), schema/table names in Browse Tables (SHOW SCHEMAS IN / SHOW TABLES IN), upload destination table name, and layer_to_insert_sql().
• WKT values embedded in ST_GeomFromWKT() calls now have single quotes defensively escaped.

API key memory hygiene

ConnectTask.run() clears self.api_key = None in a finally block so the key doesn't persist in the task object (visible to QGIS task manager / Python GC) after the connection attempt completes or fails.

WHERE clause bug fix

When the spatial extent filter was added to a query that already contained a WHERE clause, the AND condition was appended to the very end of the SQL — after any ORDER BY/LIMIT:

-- Before (broken):
SELECT * FROM t WHERE id > 5 LIMIT 100 AND ST_Intersects(...)

-- After (correct):
SELECT * FROM t WHERE id > 5 AND ST_Intersects(...) LIMIT 100

The fix mirrors the existing keyword-scan insertion logic used for the no-WHERE case.