CVE-2026-29080: Rucio has SQL Injection in FilterEngine Oracle JSON Path via DID Search API

A SQL injection vulnerability in the Oracle path of FilterEngine.create_sqla_query allows any authenticated Rucio user to execute arbitrary SQL against the backend database through the DID search endpoint (GET /dids/<scope>/dids/search). Attacker-controlled filter keys and values are interpolated directly into sqlalchemy.text via Python str.format, completely bypassing parameterization. This enables full database compromise including extraction of authentication tokens, password hashes, and all managed data identifiers. The vulnerability is affecting deployments using the default metadata plugin configuration json_meta with Oracle database backends.