Add explicit validation of order-by fields in event-counts

Prior to this commit, we weren't validating the order-by
fields for the event-counts endpoint.  This meant that if
you specified a bad field name, it was getting passed
all the way down to the SQL layer and failing there,
so you'd get a 500 rather than a 400 with a clear error
message.

This adds in the validation and ensures we get the 400.