fix(ical): only accept known columns as the calendar start date

The calendar_project_tasks and calendar_user_tasks settings were used as a
column name in the iCal query, and escapeIdentifier() leaves values with a
space or a dot untouched. A stored value like "1 OR 1=1 OR 1" made the public
project feed return tasks from every project.

Only date_creation and date_started are accepted now, anything else falls
back to date_started. The currency form also stops saving keys other than
application_currency, which is how the value could be written in the first
place.

Fixes #5904

app/Controller/CurrencyController.php

@@ -91,7 +91,7 @@ class CurrencyController extends BaseController
      */
     public function update()
     {
-        $values = $this->request->getValues();
+        $values = array_intersect_key($this->request->getValues(), array('application_currency' => ''));
 
         if ($this->configModel->save($values)) {
             $this->flash->success(t('Settings saved successfully.'));