Security: SQL executor safety check should use allowlist parser instead of regex blocklist

[Fengsh0923]

Problem

The SQL executor in base-sql-executor/utils.ts uses a regex-based blocklist (3 patterns) after stripping quoted content. This approach has known limitations with SQL dialects supporting alternative quoting, comments, and multi-statement syntax. Execution uses $queryRawUnsafe().

Suggested Improvement

1. Replace regex blocklist with parser-based allowlist (you already have node-sql-parser)
2. Set statement_timeout on read-only roles
3. Restrict available PostgreSQL functions via REVOKE EXECUTE
4. Add query complexity limits

Found during source code review. v1.10.0.