CVE-2026-55072: Pimcore: ClassDefinition UID regex missing end anchor allows SQL injection via Block.php unquoted table name

A missing end anchor ($) in the ClassDefinition UID validation regex allows an authenticated user with the objects permission to create a class with a malicious UID containing SQL. When a data object of that class is later loaded, Block.php concatenates the raw classId directly into a SQL query without quoting, executing the injected payload. This is an incomplete fix from commit dbe1d131e4 which added a leading ^ anchor but omitted the trailing $.