feat: add SQL query construction analysis (closes #1179)

[bamiebot-maker]

Summary

Implements SQL query construction analysis across engine and scanner worker boundaries:

• Engine Analyzer (libs/engine/analyzers/sql-query/):
  • sql-001: Detects SQL queries constructed with unescaped user input via string concatenation or template interpolation across database drivers (pg, sqlite, mysql, sequelize, prisma, psycopg2).
  • sql-002: Detects unsafe raw query methods called without parameter bindings (e.g. Prisma $queryRawUnsafe or cursor.execute with % string formatting).
  • sql-003: Detects incomplete or bypassable SQL sanitization (e.g. naive .replace(/'/g, "''")).
  • sql-004: Detects unquoted dynamic identifier interpolation in ORDER BY, GROUP BY, and FROM clauses.
• Worker Boundary (apps/api/src/scanner/sql-query-scan.job.ts):
  • Tenant isolation (organizationId, repositoryId, analysisJobId), safe analyzer runner with timeouts, and idempotent persistence via FindingsService.
• Fixtures & Tests:
  • Unit tests in libs/engine/analyzers/sql-query/sql-query-analyzer.spec.ts & lexer.spec.ts.
  • Worker boundary tests in apps/api/src/scanner/sql-query-scan.job.spec.ts.
  • Representative fixture repository tests in tests/fixtures/sql-query/sql-query.repositories.spec.ts.
• Documentation:
  • Detailed rules, examples, and remediation guide in docs/SQL_QUERY_ANALYSIS.md.

Closes

[drips-wave]

@bamiebot-maker Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[drips-wave]

Hey @bamiebot-maker! 👋 It looks like this PR isn't linked to any issue.

If this PR is for one of the issues assigned to you as part of a Wave, please link it to ensure your contribution is tracked properly. You can do this by adding a keyword to the PR description (e.g., Closes #123), or by clicking a button below:

Issue	Title
#1177	Add SSRF sink and source modeling	Link to this issue
#1179	Add SQL query construction analysis	Link to this issue
#1178	Detect command injection through wrapper APIs	Link to this issue

ℹ️ Learn more about linking PRs to issues