symfony/ux-autocomplete: Information exposure via unescaped LIKE wildcards in EntitySearchUtil

An unauthenticated attacker sends a crafted query parameter (e.g. `%` or `_`) to the autocomplete endpoint. Because the query is wrapped in `%...%` without escaping LIKE wildcards, sending `%` matches every row in the entity, and `_` acts as a single-character wildcard. Since `searchable_fields` defaults to all properties and the endpoint is public by default, the attacker can turn the endpoint into a broad matcher or a blind boolean oracle against every column of the entity, including columns never intended to be exposed. [CWE-807] [ref_id=2]

The vulnerability is in `Symfony\UX\Autocomplete\Doctrine\EntitySearchUtil::addSearchClause()` which builds the `LIKE` expression for the autocomplete endpoint. The method wraps the client-supplied query in `%...%` without escaping SQL `LIKE` wildcards (`%`, `_`, `\`). The autocomplete endpoint is public by default (`BaseEntityAutocompleteType` ships with `security => false`) and `searchable_fields` defaults to every property of the entity. [patch_id=6625361] [ref_id=2]

The patch escapes `\`, `%`, and `_` in the user-supplied query using `addcslashes($lowercaseQuery, '\\%_')` before wrapping it in `%...%`. It also replaces the `LIKE` expression with an explicit `ESCAPE '\\'` clause so the backslash-escaped wildcards are treated as literal characters. The exact-match `words_query` `IN()` branch is intentionally left unchanged. This ensures that a user-supplied `%` or `_` matches only rows that actually contain those characters, preventing the endpoint from being abused as a broad matcher or boolean oracle. [patch_id=6625361] [ref_id=1]