GORM Migration: Add skeleton

[MarcosDY]

Pull Request check list

• Commit conforms to CONTRIBUTING.md?
• Proper tests/regressions included?
• Documentation updated?

Affected functionality
Adds a new, optional SPIRE server datastore built on gorm v2 (gorm.io/gorm), living alongside the existing gorm v1 datastore.
This is the skeleton step: the new datastore can connect and be configured, but has no query methods yet and is not wired into the catalog, so it is unreachable by operators. Continues the gorm v2 migration after the sqlcommon extraction (#7114).

Description of change
New package pkg/server/datastore/sqlstorev2 (PluginName = "sql_v2") built on gorm v2.

A few decisions worth flagging:

• sqlite mirrors v1 exactly, same cgo mattn/go-sqlite3 driver via gorm.io/driver/sqlite, behind //go:build cgo, with the same "not supported without cgo" behavior under CGO_ENABLED=0.
• AWS RDS / IAM uses sql.Open + Conn injection. gorm v2 has no RegisterDialect, so the AWS path opens a *sql.DB from the existing awsrds driver and hands it to gorm v2 via postgres.New. The awsrds driver itself is untouched.
• MySQL custom TLS is now shared and preserved.
• AWS IAM DSN assembly and the db-type predicates are de-duplicated into sqlcommon (BuildAWS{MySQL,Postgres}DSN, Is{MySQL,Postgres,SQLite}DbType) rather than copied per datastore. Two small changes that affects v1, both moving it toward correctness:
  • v1's AWS MySQL path now rejects a password on an IAM connection (it already did this for postgres).
  • The postgres IAM password check uses pgx.ParseConfig().Password, which correctly recognizes URL, ?password=, and keyword-form passwords. It does merge libpq env fallbacks (PGPASSWORD / .pgpass), so tests isolate the environment with t.Setenv("PGPASSWORD", ""), the same guard awsrds_test.go already uses.

Known limitation (pre-existing, not introduced here): if an operator has PGPASSWORD set in their environment (not the connection string), the AWS postgres IAM path is rejected — because the awsrds driver re-parses with pgx at connect time and pgx merges env vars. This affects v1 today too; it's out of scope for this skeleton and worth a separate issue against the awsrds driver.

No docs change — the new datastore isn't selectable yet; docs land with the catalog-wiring PR.

Which issue this PR fixes
Part of: #1832

[Copilot]

Pull request overview

Adds a new (currently unreachable) GORM v2–based SPIRE Server SQL datastore skeleton (sql_v2) alongside the existing GORM v1 datastore, while extracting and reusing shared config parsing and AWS/MySQL connection helpers in sqlcommon to support the ongoing GORM migration work.

Changes:

• Introduces pkg/server/datastore/sqlstorev2 with initial connection/configure/close wiring for SQLite/Postgres/MySQL (including AWS RDS/IAM paths) and minimal tests.
• Refactors the existing v1 SQL datastore to use shared sqlcommon helpers for config parsing/validation and AWS DSN construction; consolidates MySQL custom TLS handling into sqlcommon.
• Adds GORM v2 and driver dependencies to the module.

Reviewed changes

Copilot reviewed 18 out of 19 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
pkg/server/datastore/sqlstorev2/sqlstore.go	Adds the v2 datastore skeleton, connection management, and GORM v2 logging integration
pkg/server/datastore/sqlstorev2/dialect.go	Defines the dialect abstraction for v2 datastore connections/error classification
pkg/server/datastore/sqlstorev2/errors.go	Adapts error creation to shared sqlcommon helpers
pkg/server/datastore/sqlstorev2/sqlite.go	Implements SQLite (CGO) dialect connect/version handling for v2
pkg/server/datastore/sqlstorev2/sqlite_no_cgo.go	Provides the non-CGO SQLite stub for v2
pkg/server/datastore/sqlstorev2/postgres.go	Implements Postgres/AWS IAM connect logic for v2
pkg/server/datastore/sqlstorev2/mysql.go	Implements MySQL/AWS IAM connect logic for v2, including CTE capability probe
pkg/server/datastore/sqlstorev2/sqlstorev2_test.go	Adds initial tests for v2 datastore construction/configure and shared AWS DSN behavior
pkg/server/datastore/sqlstore/sqlstore.go	Switches v1 datastore to shared sqlcommon config parsing/validation and db-type helpers
pkg/server/datastore/sqlstore/postgres.go	Switches v1 Postgres AWS IAM DSN generation to sqlcommon.BuildAWSPostgresDSN
pkg/server/datastore/sqlstore/mysql.go	Switches v1 MySQL TLS and AWS IAM DSN helpers to sqlcommon
pkg/server/datastore/sqlcommon/configparse.go	Adds shared HCL config parsing + db-type resolution + validation helpers
pkg/server/datastore/sqlcommon/configparse_test.go	Adds tests for shared config parsing/validation
pkg/server/datastore/sqlcommon/awsdsn.go	Adds shared AWS RDS/IAM DSN builders for Postgres/MySQL
pkg/server/datastore/sqlcommon/awsdsn_test.go	Adds tests for AWS DSN password-rejection behavior
pkg/server/datastore/sqlcommon/mysql.go	Adds shared MySQL TLS material handling and driver TLS config registration
pkg/server/datastore/sqlcommon/mysql_test.go	Adds tests for MySQL TLS helper behavior
go.mod	Adds GORM v2 and driver dependencies
go.sum	Adds corresponding dependency checksums/updates

[sorindumitru]

Should this be passing in true for the read only connection?

[sorindumitru]

This check wasn't there in the previous version. It's good to have, but it may be a breaking change? Might be best to remove for and replace with a comment + an issue so we remember to do it in 1.16?

[sorindumitru]

Could we remove the usage of these is*DbType and replace them with sqlcommon.Is*DbType? If there's too many of them, it's ok to have them in a separate PR

[sorindumitru]

Since this is new code, we could probably use sqlcommon.New... directly, to avoid these wrappers.