Fix SQLToolset read-only mode bypass via data-modifying CTEs and SELECT INTO

[eladkal]

Not an expert for this provider but I think we should avoid DML statements.
The validate_sql function only checked the top-level statement type, so queries like
WITH d AS (DELETE FROM users RETURNING *) SELECT * FROM d or SELECT * INTO new_table FROM users
passed validation despite mutating data. This adds a deep AST scan that walks the full parse tree
and rejects any INSERT, UPDATE, DELETE, MERGE, INTO, or Command nodes found anywhere
inside an otherwise-allowed SELECT. The scan only applies when using the default read-only allowlist;
callers who provide custom allowed_types are unaffected.

---

Was generative AI tooling used to co-author this PR?

• [v] Yes (please specify the tool below)
  Claude Opus 4.6

---

• Read the Pull Request Guidelines for more information. Note: commit author/co-author name and email in commits become permanently public when merged.
• For fundamental code changes, an Airflow Improvement Proposal (AIP) is needed.
• When adding dependency, check compliance with the ASF 3rd Party License Policy.
• For significant user-facing changes create newsfragment: {pr_number}.significant.rst, in airflow-core/newsfragments. You can add this file in a follow-up commit after the PR is created so you know the PR number.

[kaxil]

Reviewed!