feat(mysql): support session-variable init statements (e.g. wsrep_OSU_method) via ProviderConfig

### What problem are you facing?

Percona XtraDB Cluster / Galera nodes often need a session variable set on every connection to control cluster-aware DDL behavior, e.g.:

```sql
SET SESSION wsrep_OSU_method = 'NBO';
```

There's currently no way to make provider-sql's MySQL client apply session variables like this. `pkg/clients/mysql/mysql.go`'s `DSN()` only ever sets `tls` and `sql_log_bin` — there's no generic mechanism for arbitrary session variables.

### How could provider-sql help solve your problem?

Add a `sessionVariables map[string]string` field to the MySQL `ProviderConfig` (cluster and namespaced) and `ClusterProviderConfig` (namespaced) specs. Values are appended as extra DSN query parameters; go-sql-driver/mysql already runs any DSN parameter it doesn't recognize as `SET key = value` immediately after establishing a new connection (`handleParams()`), so this requires no changes to the driver — just plumbing a map through to the DSN builder.

```yaml
apiVersion: mysql.sql.crossplane.io/v1alpha1
kind: ProviderConfig
metadata:
name: default
spec:
credentials: {...}
sessionVariables:
wsrep_OSU_method: "'NBO'"
```

### Depends on #434

This depends on the connection pool work in #434 (`feat/configurable-connection-pool`). Once connections are pooled/reused rather than opened fresh per query, the DSN-param approach is the *only* way to guarantee a session variable is applied to every physical connection the pool opens — an init statement executed once after acquiring a pooled connection would only affect whichever physical connection happened to be checked out for that call. Session-variable keys also need to be sorted before being appended to the DSN so the pool's DSN-keyed cache doesn't thrash across reconciles.

A PR implementing this, stacked on top of #434, is ready: it will be opened once #434 is up for review.

Start with pkg/clients/mysql/mysql.go and inspect the DSN() builder, then trace ProviderConfig and ClusterProviderConfig specs in both cluster and namespaced APIs. Review the connection-pool work in #434 first; done means sessionVariables reaches the DSN for every physical connection, with keys sorted before appending.

Written by the indexing model from the issue text.