SQL injection through object keys in SET expansion with permitSetMultiParamEntries

When permitSetMultiParamEntries is enabled, object keys are expanded into column names by concatenating backticks around them, without escaping. A key containing a backtick closes the identifier, and the rest of the key is parsed as SQL.

The value goes through the parameter escaping, the key does not.

(report by fg0x0)