Reject xPDOQuery conditions with SQL injection attempts

Encountering a semi-colon or UNION keyword outside of quoted strings in an xPDOQuery condition triggers an xPDOException and causes the entire xPDOQuery to be effectively invalidated by adding an always false condition to the WHERE clause: 2=1
Fix bug with conditions referencing keys outside xPDOQuery::$_class

This problem was introduced in the last commit and will address modxcms/revolution#11203
Merge remote-tracking branch 'upstream/develop' into pgsql_driver