Added support for cql2 filters to the esri provider

[fredmorin]

Overview

This PR adds support for Common Query Language (CQL2) filtering to the ESRI
Feature Service provider (ESRIServiceProvider). CQL2 filter expressions are
now translated into native ESRI query parameters, enabling attribute, temporal
and spatial filtering against ArcGIS Feature/Map services through OGC API -
Features.

Attribute & temporal predicates are translated into the ESRI where
clause:

• logical operators (AND, OR, NOT)
• comparisons (=, <>, <, <=, >, >=)
• LIKE, IN, BETWEEN, IS NULL
• temporal predicates T_BEFORE, T_AFTER, T_EQUALS, T_DURING
• DATE/TIMESTAMP literal comparisons

A single spatial predicate (S_INTERSECTS, S_WITHIN, S_CONTAINS,
S_CROSSES, S_TOUCHES, S_OVERLAPS, BBOX) is translated into the ESRI
geometry, geometryType and spatialRel parameters, and may be combined
with attribute/temporal filters via a top-level AND.

Attribute values and literals are escaped (single quotes doubled) to prevent
SQL injection, and attribute names are validated against the layer fields.

Unsupported constructs return an HTTP 400 (ProviderInvalidQueryError):
S_DISJOINT, more than one spatial predicate, a spatial predicate nested under
OR/NOT, and combining the bbox query parameter with a CQL2 spatial
predicate.

Changes:

• pygeoapi/provider/esri.py — CQL2→ESRI translation (attribute, temporal,
  spatial), input validation and escaping.
• tests/provider/test_esri_provider.py — 18 new offline unit tests covering
  all supported predicates, escaping, validation and error cases.
• docs/source/publishing/ogcapi-features.rst — documentation of CQL2 support
  and limitations; updated provider capability matrix (CQL).

Related Issue / discussion

#2433

Additional information

• The new translation logic is covered by offline unit tests (no network
  access required): pytest tests/provider/test_esri_provider.py -k "cql2".
• The pre-existing live tests (and test_cql2_query_live) query
  sampleserver6.arcgisonline.com and require outbound HTTPS access.
• Note: ESRI evaluates S_WITHIN using the native esriSpatialRelWithin
  relationship, which does not return point features contained within a
  polygon; S_INTERSECTS is recommended for point layers (documented).

Dependency policy (RFC2)

• I have ensured that this PR meets RFC2 requirements

Updates to public demo

• I have ensured that breaking changes to the pygeoapi master demo server have been addressed
  • https://github.com/geopython/demo.pygeoapi.io/blob/master/services/pygeoapi_master/local.config.yml

Contributions and licensing

(as per https://github.com/geopython/pygeoapi/blob/master/CONTRIBUTING.md#contributions-and-licensing)

• I'd like to contribute CQL2 filtering support for the ESRI provider to pygeoapi. I confirm that my contributions to pygeoapi will be compatible with the pygeoapi license guidelines at the time of contribution
• I have already previously agreed to the pygeoapi Contributions and Licensing Guidelines