SQL injection through XWiki#searchDocuments API

I thought the fix in XWIKI-22718 would be enough, but XWiki#search* APIs are actually not going through the query API at all.

This API is actually not impacted by the example given in XWIKI-22718 since XWIKI-4755 (which cause the \ to be escaped, making it impossible to use the same hack on MySQL/MariaDB).

But it should be possible to use other hacks in other databases as described on XWIKI-22691.