fix: quote SQL identifiers in migration generation

[rekurt]

Motivation

• Prevent SQL injection in generated migration SQL by ensuring schema identifiers from the database are never interpolated verbatim into statements.
• Provide backend-aware quoting/escaping so generated SQL is safe for PostgreSQL (double quotes) and MySQL (backticks).

Description

• Added quote_ident(ident: &str, dialect: SqlDialect) and column_definition_sql(col: &Column, dialect: SqlDialect) helpers and used them everywhere migration SQL is constructed instead of raw identifier interpolation.
• Modified create_table_sql and create_index_sql to accept dialect: SqlDialect and to produce quoted/escaped identifiers and quoted column definitions.
• Updated all ALTER TABLE/DROP TABLE/CREATE TABLE/CREATE INDEX/DROP INDEX generation sites to call the quoting helpers and stopped using col.definition() directly in migration generation.
• Updated unit tests to assert quoted identifiers and added a regression test (postgres_identifiers_are_quoted_and_escaped) that builds a schema with malicious quoted identifiers to ensure output is escaped and not injectable.

Testing

• Ran cargo fmt --check which passed after the changes.
• Attempted cargo test -q but it failed in this environment due to crates.io dependency download being blocked (HTTP 403), so tests could not be executed here.
• Attempted cargo test -q --offline which also failed because some dependencies are not available in the local offline cache, so test execution was not completed in this environment.

---

Codex Task

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 8978872db8

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Avoid quoting full index clauses in CREATE INDEX

Quoting every entry in idx.columns breaks non-trivial index definitions because these strings are not always bare identifiers. The PostgreSQL loader extracts raw clauses from pg_indexes.indexdef (for example created_at DESC, lower(email), or already-quoted names), and wrapping each clause with quote_ident turns them into invalid or semantically different SQL ("created_at DESC", "lower(email)", etc.). This means migrations generated for expression/sorted indexes can no longer be applied.

Useful? React with 👍 / 👎.