[5.0.x] Fixed CVE-2024-42005 -- Mitigated QuerySet.values() SQL injection attacks against JSON fields.

Thanks Eyal (eyalgabay) for the report.

django/db/models/sql/query.py

@@ -2446,6 +2446,8 @@ class Query(BaseExpression):
         self.has_select_fields = True
 
         if fields:
+            for field in fields:
+                self.check_alias(field)
             field_names = []
             extra_names = []
             annotation_names = []