Marten 8.37.4

Security release. Fixes SQL injection in the LINQ provider via unescaped string literals.

Several LINQ code paths interpolated a runtime, potentially attacker-influenced value into generated SQL as a single-quoted literal without escaping or parameterization; a value containing a single quote could break out and inject SQL. The primary vector — a Dictionary<,> indexer key in a Where filter — was reported privately with an executed proof-of-concept (filter / multi-tenant authorization bypass, blind exfiltration).

Fixed sinks (this 8.x line):

• DictionaryItemMember — dictionary indexer key
• DictionaryContainsKeyFilter — ContainsKey key (Newtonsoft serializer + Enum branch)
• SelectParser — constant string projected via Select(...)

All users on 8.x should upgrade. A GitHub Security Advisory (with CVE) is being coordinated.

Back-port of #4911 (9.x).