fix(pandas-gbq): reject backticks in parse_table_id

[Samin061]

parse_table_id validates the table id but its regex only excludes "." and ":" at certain positions, so a backtick passes through into the parts that core/biglake.py and core/sample.py interpolate into a backtick-quoted FROM ... and run via bqclient.query. A backtick closes the identifier quoting and lets the remainder of the id run as SQL, and the public sample() entry point routes every table id through this one helper, so an id like p.c.n.t ORDER BY (SELECT 1) --` reaches the query. Reject backticks in parse_table_id where the id is already validated; valid project/dataset/table names can't contain one, so legitimate ids are unchanged.

• Make sure to open an issue as a bug/issue before writing your code! That way we can discuss the change, evaluate designs, and agree on the general idea
• Ensure the tests and linter pass
• Code coverage does not decrease (if any source code was changed)
• Appropriate docs were updated (if necessary)

[gemini-code-assist]

Code Review

This pull request introduces validation to reject backticks in table IDs within pandas-gbq to prevent SQL injection in downstream generated SQL queries, along with corresponding unit tests. The review feedback recommends extending this validation to also reject backslashes, which can be used to escape backticks in BigQuery SQL and bypass the protection, and suggests adding corresponding test cases.

[gemini-code-assist]

While rejecting backticks prevents direct closing of the identifier quoting, a backslash (\) can be used in BigQuery SQL to escape the closing backtick (e.g., ```). If a table ID ends with a backslash, it would escape the closing backtick in the generated SQL, potentially leading to SQL injection or syntax errors if there are subsequent backticks in the query. Since backslashes are not valid characters in BigQuery project, dataset, or table IDs, they should also be rejected here to prevent any escaping-based bypasses.

Suggested change

	if "`" in table_id:
	raise ValueError(f"Invalid table ID: {table_id}")
	if "`" in table_id or "\\" in table_id:
	raise ValueError(f"Invalid table ID: {table_id}")

[gemini-code-assist]

In addition to backticks, we should also test that table IDs containing backslashes are rejected, as they can be used to escape the closing backtick in generated SQL.

        "my-project.my_dataset.my_table` ORDER BY (SELECT 1) -- ",
        "my-project.my_catalog.my_namespace.evil` UNION ALL SELECT 1 -- ",
        "my-project.my_dataset.`",
        "my-project.my_dataset.my_table\\",
        "my-project.my_dataset.my_\\table",

[parthea]

nit (non-blocking): We could move this before the regex_match on line 48 but I don't have a strong opinion about it