fix: SQL identifier injection

[techmahedy]

Summary

Three security fixes for the ORM/query layer, found during a framework-wide review:

• Session fixation: Authenticate::setUser() now regenerates the session ID on every login path (fresh login, 2FA completion, remember-cookie resume) before writing the auth key.
• Mass-assignment on update: save()-as-update and update() previously skipped the $creatable whitelist filter entirely when a model didn't declare $creatable (only insert enforced it). Both paths now require $creatable to be declared, matching insert's existing guarantee.
• SQL identifier injection: where(), orderBy(), groupBy(), whereIn(), whereBetween(), whereNull(), whereLike(), and the whereDate/whereMonth/whereYear/whereDay/whereTime helpers interpolated column names (and orderBy's direction) into SQL with no validation — only values were bound. Added a strict identifier allowlist (column or table.column) validated at each entry point, across both query builder classes (Entity\Builder and Entity\Query\Builder). whereRaw()/orderByRaw()/groupByRaw() remain the unchanged, intentional raw-SQL escape hatch.