fix: prevent field label leak through rule parameters in validation messages

[gr8man]

Description

Validation::getErrorMessage() used the rule parameter as a key into the
defined field rules to substitute the referenced field's label in the error
message. When a parameter that was not a field reference (e.g. a numeric
limit like min_length[secret]) coincidentally matched a defined field
name, that field's label leaked into the error message (information
disclosure of internal field labels plus a wrong message).

Label substitution now only applies to rules whose parameter is a field
reference: matches, differs, required_with, required_without. Other
rules render the parameter verbatim.

Checklist:

• Securely signed commits
• Component(s) with PHPDoc blocks, only if necessary or adds value (without duplication)
• Unit testing, with >80% coverage
• User guide updated
• Conforms to style guide