[8.x] Wrap column in aggregate function

[sebdesign]

In general, columns in raw expressions need to be wrapped for safety.

This PR wraps the $column parameter in the aggregate $function, because it's easy to pass arbitrary SQL as an argument to the $column parameter.

[taylorotwell]

Just want to note that wrapping doesn't prevent SQL injection. You can't bind column names in PDO as bound parameters so they have to be concatenated into the query as plain strings. The wrapping just prevents the DB from erroring if the column name is a reserved word used by the DB.

[sebdesign]

Thank you for the clarification, I assumed that the wrapping would provide some basic security apart from preventing SQL errors.