Fix N1QL injection in nested Hash attribute updates

Parameterize Hash values in build_update_with_params using bind()
instead of direct string interpolation, which was both a security
vulnerability and defeated prepared-statement caching.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: pimpin

lib/couchbase-orm/relation.rb

@@ -225,7 +225,7 @@ def build_update_with_params(params, **cond)
                     end
                     if value.is_a?(Hash)
                         value.map do |k, v|
-                            "#{key}.#{k} = #{v}"
+                            "#{key}.#{k} = #{@model.bind(v, params)}"
                         end.join(", ") + for_clause
                     else
                         "#{key} = #{@model.bind(value, params)}#{for_clause}"