fix(security): Resolve SonarQube security hotspots

Introduce a default regex match timeout across the library to prevent potential ReDoS attacks (SonarQube rule S6444).
Implement `[OnDeserialized]` methods to re-establish object invariants and validate state after deserialization, addressing SonarQube rule S5766.

src/Strata.SqlTools.Query/CalculationFilterGroup.cs

@@ -2,18 +2,24 @@ using System.Text.Json.Serialization;
 
 namespace Strata.SqlTools.Query;
 
-[method: JsonConstructor]
-public class CalculationFilterGroup(IEnumerable<CalculationFilter> filters, LogicalOperator logicalOperator)
+public class CalculationFilterGroup
 {
-    // Hereditary logical operation applied to all Filters
-    public LogicalOperator LogicalOperator { get; set; } = logicalOperator;
-
-    public IEnumerable<CalculationFilter> Filters { get; set; } = filters;
+    [JsonConstructor]
+    public CalculationFilterGroup(IEnumerable<CalculationFilter> filters, LogicalOperator logicalOperator)
+    {
+        Filters = filters;
+        LogicalOperator = logicalOperator;
+    }
 
     public CalculationFilterGroup() : this([], LogicalOperator.And)
     {
     }
 
+    // Hereditary logical operation applied to all Filters
+    public LogicalOperator LogicalOperator { get; set; }
+
+    public IEnumerable<CalculationFilter> Filters { get; set; }
+
     public IEnumerable<CalculationFilter> GetValidFilters()
     {
         return Filters?.Where(x => x.IsValid()).ToList() ?? [];