GHSA-rxhg-vcww-2mpw: Fleet: ORDER BY column injection on activity list endpoints

An authenticated user with read access to Activity could influence the ORDER BY clause of the activity list endpoints by supplying an arbitrary sort column:

• GET /api/v1/fleet/activities (ListActivities)
• GET /api/v1/fleet/hosts/{id}/activities (ListHostPastActivities)

This originated from the deprecated cursor-pagination helper (appendListOptionsWithCursorToSQL), which interpolated the caller-supplied order key into SQL without an allowlist. The original report’s node_key extraction scenario (/api/v1/fleet/labels/{id}/hosts) was remediated separately in #44385; these two activity endpoints were the residual call sites, neither of which joins the hosts table, so node_key was never reachable through them.