fix: apply sort request for columns marked sortable after list construction

[gharlan]

Fixes #6585

Problem

Since the sort column is validated against the sortable columns (GHSA-4f5f-j737-pm58, #6580), sorting via column headers stopped working: the query runs in the rex_list constructor, but setColumnSortable() is called afterwards, so the whitelist was always empty at the time prepareQuery() built the ORDER BY.

Solution

When a sort request is pending (list param matches and sort param present), the constructor no longer loads the data. It fetches only the field names via a LIMIT 0 metadata query (optimized away by MySQL, needed for getColumnNames()/addColumn() etc.) and defers the data query to get() — at that point all sortable columns are registered, including those added via the REX_LIST_GET extension point.

• Requests without a sort param behave exactly as before (no additional query).
• Sorted views: count + LIMIT 0 metadata + one data query with the validated ORDER BY.
• Non-whitelisted sort params still fall back to the default order (security fix stays intact, covered by a new test).
• getRows()/getValue() lazily trigger the initial data load in case they are used before get(); get() re-executes only if the effective query changed in the meantime.

Note: existing rex_list behavior is unchanged in that a query with a hardcoded ORDER BY (and no $defaultSort) still ignores sort requests — use the $defaultSort factory parameter instead.

Verified end-to-end in the backend (users list, cronjobs list with temporarily enabled sortable columns): default sort, asc/desc via column headers, and rejected non-sortable columns.

[bitshiftersgmbh]

Danke @gharlan <3