SQL injection vulnerabilities in label search

Editor assessment

This commit patches CVE-2026-34612. The subject identifies SQL injection in label search across the `flows` and `executions` areas, a clear and appropriately scoped description of the defect. The entire body is a single advisory link introduced by `Fixes https://...`, which gestures at the issue without explaining the vulnerable query, the injection vector, or the fix approach. The footer also omits the colon required for a machine-readable `token: value` separator, so it fails the footer grammar check. Referencing the GHSA is better than nothing, but it shifts all context to an external page. Readable and correctly typed, but too thin to serve as a teaching example.