fix(security): avoid blocked keyword false positives in SQL literals and comments

[tuoluzhe8521]

A valid read-only query such as SELECT 'ios_created_time_parse_failure' AS metric is rejected as CREATE because the keyword blocklist searches for substrings inside literal and comment tokens. Ordinary comments such as SELECT 1 /* CREATE TABLE example */ fail for the same reason.

This change matches actual SQL keyword tokens instead of inspecting non-executable token contents. It preserves configured compound keywords, recognizes CREATE OR REPLACE, and retains statement-leading commands such as KILL and SHUTDOWN when sqlparse classifies them as names. Reported blocked operations are deduplicated and sorted.

Regression tests cover literals, ordinary comments, quoted identifiers, CTEs, real blocked operations, and configured compound keywords. Existing injection checks, the canonical read-only guard, error codes, and query complexity limits are unchanged.

Validation (Python 3.12, frozen development environment):

• uv run pytest -q -W error: 1880 passed, 85 skipped; 68.13% coverage.
• SQL validation, injection, and operation-policy suites: 151 passed.
• uv run ruff check ., uv run mypy doris_mcp_server, and Bandit source scan passed.
• Lock-file check, generated tool-catalog check, and domain coverage floors passed.