feat(cloudsqlpg): add native read-only session locking

[anubhav756]

Overview

This PR implements native read-only session locking for Cloud SQL PostgreSQL.

Changes

• Updates the connection logic to automatically inject options='-c cloudsql_session_read_only=locked' into the DSN for read-only sources.
• Includes a new vulnerability test verifying that the underlying database kernel intercepts and blocks any destructive queries, even if an AI agent maliciously attempts to bypass the AST parser.

[gemini-code-assist]

Code Review

This pull request introduces read-only support for Cloud SQL Postgres by adding a CLOUDSQL_PG_READONLY configuration, a new execute_sql_readonly tool, and enforcing the cloudsql_session_read_only=locked option in the connection string. An integration test is also added to verify that write operations are rejected in read-only mode. The feedback suggests improving the integration test's robustness by making the error message assertion case-insensitive.

[anubhav756]

/gemini review

[gemini-code-assist]

Code Review

This pull request introduces a read-only mode for the Cloud SQL Postgres source, adding configuration options, a read-only execution tool, and DSN-level enforcement using cloudsql_session_read_only=locked. It also includes an integration test to verify that write operations are rejected under this mode. The reviewer feedback suggests improving the integration test by constructing the configuration map directly in Go rather than parsing a raw YAML template string, which also allows removing the unused gopkg.in/yaml.v3 import.