security: mitigate SQL injection in vector index management

[inco308]

Fixes #2290

Summary
This PR fixes a SQL injection issue in PostgresChunksHandler by applying strict validation and safe quoting to all user-supplied database identifiers used in index management. It prevents arbitrary SQL injection via index_column and index_name.

Changes

• Added psql_quote_identifier utility in py/core/providers/database/utils.py to safely double-quote SQL identifiers.
• Implemented whitelist validation for index_column in create_index (only allow known column names).
• Enforced strict validation for index_name with regex (^[A-Za-z0-9_]+$) and length limits (max 63 chars).
• Applied safe identifier quoting to schema, table, column, and index names before embedding them in SQL for both create_index and delete_index.
• Added automated unit tests to ensure validation logic correctly intercepts malicious payloads.

How to test

• Automated tests:
  • pytest py/tests/unit/database/test_security.py — ensures malicious index_name / index_column raise ValueError and do not lead to execution.
• Manual verification (isolated environment):
  1. Start a disposable Postgres instance.
  2. Run the PoC curl command (from the linked Issue) against the patched service.
  3. Expected: Request returns 400 / validation error; no public.poc_success_executed table is created in the database.

Compatibility & migration

• Users utilizing non-standard index names (e.g., containing special characters) may need to rename indexes to conform to the new regex validation.

Security note

• Recommend setting AuthConfig.require_authentication = True for production and restricting /v3/indices to RBAC-managed roles.