Fix blind SQL injection level 2

[r1kka6]

Summary

• parameterize the Blind SQLi Level 2 car lookup instead of concatenating the quoted id
• add a regression test proving the quoted boolean payload is bound as data

Verification

• docker run --rm --user 501:20 -e GRADLE_USER_HOME=/tmp/gradle-home -v /Users/snow/.gradle:/tmp/gradle-home -v "$PWD:/workspace" -w /workspace gradle:8.10.2-jdk17 ./gradlew test --tests org.sasanlabs.service.vulnerability.sqlInjection.BlindSQLInjectionVulnerabilityTest
• docker run --rm --user 501:20 -e GRADLE_USER_HOME=/tmp/gradle-home -v /Users/snow/.gradle:/tmp/gradle-home -v "$PWD:/workspace" -w /workspace gradle:8.10.2-jdk17 ./gradlew test --tests 'org.sasanlabs.service.vulnerability.sqlInjection.*' spotlessJavaCheck
• docker run --rm --user 501:20 -e GRADLE_USER_HOME=/tmp/gradle-home -v /Users/snow/.gradle:/tmp/gradle-home -v "$PWD:/workspace" -w /workspace gradle:8.10.2-jdk17 ./gradlew test spotlessJavaCheck

Runtime

• baseline LEVEL_2?id=100%27OR%20%271%27%3D%271 returned 200 { "isCarPresent": true}
• patched LEVEL_2?id=100%27OR%20%271%27%3D%271 returned generic 500, matching the existing secure Level 3 behavior
• valid id=1 and missing id=100 still return the original 200 true/false responses