Fix SQL injection in biobank DAO selectInstances and cascade update

[HenriRabalais]

Brief summary of changes

Fixes SQL injection in the biobank module's DAO layer. The selectInstances
methods in the container, specimen, pool, and shipment DAOs built their WHERE
clauses by concatenating $condition['value'] directly into the query string
and passed an empty parameter array to pselectWithIndexKey. User-supplied
values reaching these methods (e.g. a container barcode or shipmentBarcodes
via the container endpoint) could break out of the quoted string and inject
arbitrary SQL.

Both reported exploits hit the same DAO code through different fields:

• barcode -> containerdao::selectInstances (via container validation)
• shipmentBarcodes -> shipmentdao::selectInstances (via shipment validation)

All four selectInstances methods now bind values to named placeholders and
pass them through to pselectWithIndexKey. Column names are left interpolated
as before, since every caller supplies them as hardcoded literals, never from
user input.

Additionally, containerdao::_cascadeToChildren built an UPDATE ... SET $field=$value query with the value interpolated raw. $value originates from
user-submitted container data (temperature, status, center), so this was a
second injection point on the same endpoint. It now binds the value via a
prepared statement.

Testing instructions

1. Check out this branch on a LORIS instance with the biobank module enabled.
2. Log in and obtain a session cookie.
3. Attempt the reported exploit against the container endpoint, e.g. a POST with
   a barcode of a" AND extractvalue(1,concat(0x7e,(SELECT @@version)))-- -.
4. Confirm the request no longer returns a database error leaking server
   information, and that the injected value is treated as a literal barcode.
5. Exercise normal biobank flows (create/edit containers, specimens, pools,
   shipments; cascade a temperature/status/center change to child containers)
   and confirm behaviour is unchanged.

Link to any issues this addresses

Reported via the Programme privé de prime aux bogues du Gouvernement du Québec
(YesWeHack). Internal refs: RITM0025010, RITM0024993.

[skarya22]

Following for once it is on 28.0-release

[HenriRabalais]

@skarya22 done!