chore(core): removes usages of extract() function

Fixes #6141
security(river): sanitizes results of 'creating', 'river' plugin hook before river insert.

Refs #6141
chore(river): refactor river item create SQL generation