fix(examples): any text reaches the mongo stock filter as a sku (CodeQL go/sql-injection) #255

CodeQL (go/sql-injection) flags the MongoDB stock datastores: the sku from the request goes straight into the filter.

• alert 9 and 10: examples/stock/internal/pkg/datastore/stock/mongodb/datastore.go (new in the 1.7.0 release PR release: 1.7.0 #254)
• alert 5: docs/site/example/shop/internal/pkg/datastore/stock/mongodb/datastore.go (already on main)

In Go the sku is a string, so Mongo never reads it as an operator: no real injection. Still, the example app takes any text as a sku ($gt, spaces, empty) and sends it to the datastore.

Intended behavior:

• examples/stock: a sku outside [a-z0-9-] (1 to 64 chars) is rejected as Bad Request / InvalidArgument at every door, before any datastore.
• both mongodb datastores match the sku with an explicit $eq.
• the three alerts are dismissed as false positive, pointing to this issue.