[Aikido] Fix SQLite mixed placeholder IDOR bypass in IDOR protector

[aikido-autofix]

This patch addresses an IDOR (Insecure Direct Object Reference) vulnerability in SQLite query analysis where mixed positional placeholders (numbered ?NNN and bare ?) could cause incorrect parameter binding detection. The fix enhances the IDOR protector to validate placeholder consistency and fail safely when the analyzer's ordinal assignment would not match SQLite's actual parameter binding behavior. Changes were made to lib/aikido/zen/idor/protector.rb and lib/aikido/zen/sql.rb to pass the original SQL query through the protection chain, enabling proper placeholder validation during insert and filter operations.

✅ 1 issue fixed by this PR

Issue	Severity	Description
CodeAudit#811806027	HIGH	The analyzer records only bare ? tokens and assigns their ordinal among those tokens. The SQLite resolver then returns params[placeholder_number] for that ordinal. For WHERE status = ?1 AND tenant_id = ? with binds [status, requested_tenant_id], the analyzer assigns the tenant placeholder ordinal 0, so the protection layer validates params[0]; SQLite assigns ?1 slot 1 and the later anonymous placeholder slot 2, so the executed tenant predicate uses params[1]. In an application using this mixed-placeholder pattern where the non-tenant bind is attacker-controlled, an authenticated user can make the check compare a value they control to their own tenant while the query executes against another tenant.

[codecov]

Codecov Report

❌ Patch coverage is 83.33333% with 2 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
lib/aikido/zen/sql.rb	66.66%	2 Missing ⚠️

📢 Thoughts on this report? Let us know!