MDEV-40653 Various SQL injections paths mitigation

[drrtuy]

Harden DuckDB SQL forwarding against injection

What

Prevent SQL injection caused by MariaDB and DuckDB lexer differences when forwarding queries. Ensure generated DuckDB SQL safely handles crafted identifiers and reject queries whose backslash-escape semantics could change quote boundaries.

Key changes

• Add centralized DuckDB identifier quoting with embedded double-quote escaping.
• Apply safe quoting across DDL, DML, pushdown, schema, and delta-appender paths.
• Replace naive backtick conversion with lexer-aware handling of strings, comments, and quoted identifiers.
• Reject forwarded SQL when MariaDB and DuckDB parse backslash-escaped quotes differently.
• Execute non-streaming statements through DuckDB’s single materialized pending-query path and add identifier/lexical-guard regression coverage.

How to test

Run:

storage/duckdb/run_mtr.sh duckdb_identifier_escaping