fix: Validate sort_by parameter against allowlist in repositories

[daveearley]

Summary

• Multiple repository classes were passing the user-supplied sort_by query parameter directly to Eloquent's orderBy() without validation, enabling SQL injection (PostgreSQL supports stacked queries, so this is particularly spicy)
• Added validateSortColumn() and validateSortDirection() helpers to BaseRepository that check against each domain object's existing getAllowedSorts() whitelist
• Applied validation across all 11 affected repository files — invalid values silently fall back to defaults
• Added IsSortable to ProductCategoryDomainObject (the one domain object that was missing it)

The allowlist pattern was already used correctly in the admin endpoints (getAllEventsForAdmin, getAllOrdersForAdmin) — this just applies the same approach everywhere else.

Test plan

• All 350 unit tests pass
• Verify sorting still works on attendees, orders, events, promo codes, etc.
• Confirm invalid sort_by values fall back to defaults instead of erroring

Reported by @tikket1