[Bug]: Bookmark variables with non-sequential [VARIABLEn] numbers are silently dropped #20348

Describe the bug

Bookmark::getVariableCount() (Bookmarks/Bookmark.php on master,
libraries/classes/Bookmark.php on QA_5_2) counts how many [VARIABLEn]
placeholders occur in the bookmarked query, but applyVariables() uses that
count as if it were the highest variable number referenced. Those are not
the same thing whenever the numbering has a gap or a repeated number.

When a bookmarked query uses non-sequential variable numbers (e.g.
[VARIABLE1] and [VARIABLE3], skipping [VARIABLE2]), getVariableCount()
returns 2 (it counted 2 occurrences) instead of 3. As a result:

• The UI only renders input boxes for "Variable 1" and "Variable 2" — there is
  no way to fill in a value for [VARIABLE3].
• applyVariables()'s substitution loop only runs up to $i = 2, so
  [VARIABLE3] is never replaced.
• The literal text [VARIABLE3] stays in the query that actually gets
  executed, which is invalid SQL and fails.

Nothing in the documentation (docs/bookmarks.rst) requires variable numbers
to be sequential without gaps, so this is reachable by normal use of the
feature, not just malformed input.

How to Reproduce

1. Go to a table's SQL tab.
2. Enter and execute:

   SELECT * FROM `some_table` WHERE 1 /* AND col1 = [VARIABLE1] */ AND 1 /* AND col2 = [VARIABLE3] */

3. Click "Bookmark this query" and save it.
4. Reload the SQL tab and select the bookmark from the bookmark dropdown.
5. Notice only two variable input boxes appear ("Variable 1" and "Variable
   2") — there is no box for the third placeholder used in the query.
6. Fill in the two boxes shown and submit.
7. The executed query still contains the literal text [VARIABLE3] and MySQL
   returns a syntax error.

Expected behavior

The number of variable boxes shown, and the number of substitutions applied,
should match the highest variable number actually referenced in the query
(3 in the example above), not the number of placeholder occurrences.

Additional context

This is not a regression introduced by the src/ restructuring for 6.0 — the
exact same logic (same regex, same loop bound) exists unchanged in
QA_5_2's libraries/classes/Bookmark.php, so the currently released 5.2.x
line is affected too. I have fixes ready for both master and QA_5_2 and
will open a pull request against each referencing this issue.

Operating System

Arch Linux (kernel 7.0.13-arch1-1)

PHP version

8.2.32

phpMyAdmin version

master (6.0.0-dev) and 5.2.3 (QA_5_2)