fix: escape custom-table names in raw SQL, add missing docblocks

[miyanialkesh7]

Summary

Plugin Check flagged 65 UnescapedDBParameter warnings for custom
table names ($wpdb->prefix . 'webdecoy_...') interpolated into raw
SQL strings. 48 are fixed here by wrapping the assignment in
esc_sql() at the point the table name is built, across the rate
limiter, IP blocker, detector, WooCommerce checkout tracking, and the
statistics/detections admin pages.

17 are deliberately left alone:

• 6 in class-webdecoy-violation-reporter.php — this file is loaded
  standalone (no WordPress) by tests/ViolationDrainTest.php, and
  esc_sql() doesn't exist outside WordPress. Confirmed by testing
  it directly: the suite breaks with Call to undefined function esc_sql().
• 11 are derived variables ($where, $query, $export_query,
  $table via a method call) where the actual SQL is already
  correctly parameterized through $wpdb->prepare(). Plugin Check's
  analyzer loses track a few layers removed from the original
  assignment; it's a tool limitation, not a real gap.

Also adds missing docblocks to 5 constructors and 9 methods across
the plugin, matching the existing /** Constructor ... */ style
already used elsewhere in the codebase. Left two methods undocumented
on purpose (WebDecoy_Rate_Limit_Rule::getName()/evaluate()) since
sibling rule classes (TripwireRule, FilterRule) rely on the
interface's docblock rather than repeating it — adding one here would
have been inconsistent with that existing pattern.

Test Plan

• php tests/run.php — 196 passed, 0 failed
• vendor/bin/phpstan analyse — no errors
• vendor/bin/phpcs (project's security+DB ruleset) — same baseline (2 pre-existing errors, 148 warnings; none newly introduced)
• Manually verified the esc_sql() fix resolves the Plugin Check finding (tested against includes/class-webdecoy-blocker.php before/after)
• Manually verified esc_sql() breaks standalone tests where applied incorrectly, confirming which files must be excluded (tested and reverted)
• Activated and deactivated the plugin on a local WordPress install — no fatals
• php -l on all 18 changed files — no syntax errors