fix(sqlite): prevent SQL injection in describe_table and query tools

[xr843]

Summary

• Fixes a critical SQL injection vulnerability in the SQLite MCP server's describe_table tool (OWASP A03:2021 — Injection)
• The table_name parameter was interpolated directly into a PRAGMA query via f-string without any sanitization
• Adds defense-in-depth validation: regex identifier check + whitelist validation against sqlite_master + bracket quoting

Fixes #3314

Vulnerability

The describe_table tool at src/sqlite/src/mcp_server_sqlite/server.py constructed SQL using unsanitized string interpolation:

# BEFORE (vulnerable)
results = db._execute_query(
    f"PRAGMA table_info({arguments['table_name']})"
)

An attacker could provide a crafted table_name like users); DROP TABLE users; -- to execute arbitrary SQL.

Fix — Defense-in-Depth

1. Regex identifier validation (_validate_identifier)

Rejects any identifier containing characters other than [a-zA-Z0-9_.], blocking SQL metacharacters (;, ), ', --).

2. Whitelist validation against sqlite_master (_validate_table_name)

Uses a parameterized query to verify the table actually exists before using it:

results = self._execute_query(
    "SELECT name FROM sqlite_master WHERE type IN ('table', 'view') AND name = :name",
    {"name": table_name},
)

3. Bracket-quoted identifier

The validated table name is wrapped in SQLite bracket quoting ([table_name]) as a final safeguard:

# AFTER (safe)
table_name = db._validate_table_name(arguments["table_name"])
results = db._execute_query(f"PRAGMA table_info([{table_name}])")

Note on repo structure

The SQLite MCP server was previously archived to servers-archived (which is now read-only and cannot accept PRs). This PR re-introduces the sqlite source with the security fix applied. Maintainers may prefer to apply this patch to the archived repo directly or handle it differently.

Test plan

• Verify describe_table works correctly with valid table names
• Verify injection payloads like users); DROP TABLE users; -- are rejected with a clear error
• Verify non-existent table names return a "Table not found" error
• Verify names with special characters (;, ', ", -) are rejected by the regex validator