fix(security): enforce root CA verification and expose TLS sslmode for PostgreSQL connections #1367

Summary

In PostgresConnection (lib/core/database/postgres_connection.dart, lines 46–60, 187–212):

SslMode postgresResolveSslMode({
  SslMode? uriSslMode,
  required bool encrypt,
  required bool hasRootCert,
}) {
  if (uriSslMode != null) return uriSslMode;
  if (!encrypt && !hasRootCert) return SslMode.disable;
  if (hasRootCert) return SslMode.verifyFull;
  return SslMode.require;
}

When a user enables SSL (useSSL == true) without uploading a custom sslrootcert file:

1. _buildSettings() keeps securityContext = null.
2. postgresResolveSslMode defaults to SslMode.require.
3. In postgres 3.5.x, SslMode.require disables CA root verification and disables hostname verification (onBadCertificate: (cert) => true). Traffic is encrypted, but open to Man-in-the-Middle (MITM) interception on untrusted networks (public Wi-Fi, compromised routers, cloud VPC gateways).
4. Furthermore, the standard Postgres connection form does not expose sslmode (require, verify-ca, verify-full), preventing users from configuring strict certificate validation against system CAs.

Problem Details

• Cloud providers (AWS RDS, Supabase, Neon, GCP Cloud SQL) provide certificates signed by public CAs or installed system roots.
• Even when connecting to these secure cloud endpoints with "Enable SSL" turned on, MITM attacks are possible because SslMode.require ignores certificate trust chains.
• As noted in postgres_connection.dart: "require does not check the CA — MITM is possible."
• When uriSslMode == SslMode.verifyFull is passed via URL query without sslRootCert, _buildSettings() still leaves securityContext = null, rather than using SecurityContext(withTrustedRoots: true).

Scope

• In PostgresConnection._buildSettings(), when useSSL or verifyFull/verifyCa is enabled without a custom root cert, initialize SecurityContext(withTrustedRoots: true) so system root CAs are available.
• Expose sslmode option (require, verify-ca, verify-full, disable) in the connection configuration and URL parser.
• Add unit tests verifying SecurityContext and SslMode resolution for various SSL configurations.

Out of Scope

• SSH tunnel encryption (already covered in SshTunnelManager).