fix: SQL query validator bypasses

[jxom]

Fix three audit findings in the query validator:

1. GROUP BY GROUPING SETS Skips Function Allowlist

Expressions inside GROUPING SETS modifiers (and GROUP BY ALL modifiers) were not validated, allowing set_config() session poisoning via:

SELECT 1 FROM blocks GROUP BY ALL GROUPING SETS ((set_config('a','b',true)))

2. Aggregate Argument ORDER BY Skips Function Allowlist

Function calls inside ORDER BY within aggregate arguments were not validated:

SELECT string_agg(hash, ',' ORDER BY set_config('a','b',true)) FROM blocks

3. Ipad/rpad/repeat Memory Exhaustion DoS

lpad(), rpad(), and repeat() with large length arguments could allocate unbounded memory. Added a 100,000 cap on the length argument:

SELECT lpad('x', 999999999) FROM blocks  -- now rejected

All three bypasses now have unit tests verifying rejection and that normal usage still works.