sql-js session interpolates config.behavior into raw SQL without validation

drizzle-orm/src/sql-js/session.ts:55 does sql.raw(\`begin \${config.behavior}\`). The behavior field is meant to be 'deferred', 'immediate', or 'exclusive', but there's no validation before it hits raw SQL.

If an app passes user input into SQLiteTransactionConfig.behavior, that goes straight into the query. Adding a whitelist check would close this off.