[5.x] Fix SQL corruption in QueryWatcher when named bindings share a prefix

[haminh7036]

When executing raw bulk queries with dynamically indexed named placeholders (e.g. bulk replacing product attributes), QueryWatcher::replaceBindings() matches and replaces prefixes of longer placeholders.

DB::statement('
    REPLACE INTO product_attributes (product_code, column_id, column_value) VALUES 
    (:product_code1, :column_id1, :column_value1),
    ...
    (:product_code10, :column_id10, :column_value10)
', [
    'product_code1' => 'P01', 'column_id1' => 1, 'column_value1' => 'Red',
    ...
    'product_code10' => 'P01', 'column_id10' => 10, 'column_value10' => 'Cotton',
]);

Because :column_value1 is a prefix of :column_value10, QueryWatcher partially replaces :column_value10 and corrupts the logged SQL into 'Red'0.

This PR adds (?![a-zA-Z0-9_]) so the named-binding regex only matches complete parameter names. Regression test included.

(Follow-up to #1765)