AC-2596: Return 400 for unsupported sort field

[Okspen]

Paginated endpoints return 500 internal_server_error when the sort parameter names a field that is not configured for ordering, e.g. ?sort=bogus_field.

ConfiguredQuery::getOrderingConfigurationFor() from paysera/lib-pagination throws InvalidOrderByException in this case. ErrorBuilder already maps the other client-side pagination exceptions (TooLargeOffsetException, InvalidCursorException), but not this one, so it fell through to the generic 500.

The sort value is client input, so InvalidOrderByException is now mapped to invalid_parameters (400):

{"error":"invalid_parameters","error_description":"Unsupported order-by field: \"bogus_field\""}

InvalidGroupByException still returns 500: it is caused by how the query is built on the server, not by client input.

InvalidOrderByException exists since paysera/lib-pagination 1.0.0, so the dependency constraint is unchanged.

CI fix

Composer 2.10 refuses to install packages with security advisories by default. All symfony/cache releases for Symfony 3.4 and 4.4 (end-of-life) are affected, so those matrix jobs failed at dependency install. The workflow now sets policy.advisories.block to false before installing. This only affects the library's own test installs; projects using the bundle keep their own Composer settings. The step is skipped on PHP 7.1, which gets Composer 2.2: it does not block advisories and does not know this setting.

Test Plan

• New functional case in FunctionalPagedQueryTest: GET /paged-query/simple?sort=bogus_field returns 400 invalid_parameters. It fails with the 500 body before the fix.
• Full suite passes locally (PHP 8.5, Symfony 6.*): 259 tests, 506 assertions.
• CI matrix passes (all 23 jobs).