order_by() lacks explicit field-name whitelist guard analogous to aggregate patch

Description

ormar's `order_by()` does not have an explicit `field_name not in model_fields` check at construction time, unlike the `min()`/`max()`/`sum()`/`avg()` aggregate methods patched in CVE-2026-26198. Column alias lookup acts as an implicit guard (raises KeyError on unknown fields) and SQLAlchemy's identifier quoting mitigates raw injection, but there is no upfront validation equivalent to the aggregate patch.

Reproduction

# ormar.order_by() with an invalid field name:
# await Item.objects.order_by('nonexistent_field').all()
# Raises KeyError from column alias lookup (implicit guard, not explicit)
# Compare: Item.objects.min('nonexistent') raises QueryDefinitionError immediately (explicit guard)
# Recommendation: add 'if field_name not in model.ormar_config.model_fields: raise' to order_by()