test(security): add security-specific test suite

[Snider]

Finding

No dedicated security test suite exists to verify input sanitisation, authentication, authorisation, and CSRF protections.

Fix

Create a security-focused test suite covering OWASP Top 10 scenarios relevant to the framework.

Acceptance Criteria

• XSS injection tests for input sanitisation
• SQL injection tests for query building
• CSRF protection verification
• Authentication bypass attempt tests
• Authorisation boundary tests (tenant isolation)
• SSRF prevention tests
• Tests use Pest syntax and are in a dedicated Tests/Security/ directory

[Snider]

Parent: #106