build.rs: unverified \curl … | sh` pipeline downloads & executes ClickHouse at build time`

## Summary

`jetstreamer-utils/build.rs` pipes a remote installer script directly into a shell on every `cargo build`, with no version pin, checksum, or signature check. The resulting binary is then `include_bytes!`'d into the published crate.

## Location

[`[jetstreamer-utils/build.rs:28-33]`](../blob/main/jetstreamer-utils/build.rs#L28-L33)

```rust
let status = Command::new("sh")
.arg("-c")
.arg("curl https://clickhouse.com/ | sh")
.current_dir(&out_dir)
.status()
.expect("Failed to download and install ClickHouse");
```

## Impact

Anyone who compromises `clickhouse.com` (DNS hijack, CDN/origin breach, namespace takeover, or operator mistake) gets code execution on every developer and CI machine that builds this workspace. Because the downloaded binary is embedded into `jetstreamer-utils` via `include_bytes!`, the compromise also propagates to downstream consumers built from that artifact.

There is also no observable failure mode: the installer is a moving target, and a tampered build will be indistinguishable from a normal one to `cargo build`.