fix: always escape string attributes

[ephys]

Pull Request Checklist

• Have you added new tests to prevent regressions?
• If a documentation update is necessary, have you opened a PR to the documentation repository?
• Did you update the typescript typings accordingly (if applicable)?
• Does the description below contain a link to an existing issue (Closes #[issue]) or a description of the issue you are solving?
• Does the name of your PR follow our conventions?

Description Of Change

This removes a security vulnerability we have where attributes would not be escaped if they included ( and ), or where equal to *, and were split if they included the character .

Users must always use literal or col to inline something without escaping.

The special syntax is still available when using col. We'll need to provide something like identifier() that only escapes, and thoroughly document col.

The following

User.findAll({
  attributes: [
    '*',
    'a.*',
    ['count(id)', 'count']
  ]
});

used to return this:

SELECT *, "a".*, count(id) AS "count" FROM "users"

now it returns this:

SELECT "*", "a.*", "count(id)" AS "count" FROM "users"

The previous behavior can be restored by writing this instead:

User.findAll({
  attributes: [
    col('*'),
    col('a.*'),
    [literal('count(*)'), 'count'],
    // or
    // [fn('count', col('*')), 'count'],
  ],
});

---

This is also the case for the "returning" option. The following, which previously was equivalent to returning: true, now only returns the column "*".

User.findAll({
  returning: ['*'],
});

If you want to return *, do this instead:

User.findAll({
  returning: [literal('*')], // col() works too
});

[WikiRik]

Small comment, but great work! Also bit weird to see that one of our deprecations is really removed now