Sanitize SQL queries

### Problem Statement

Our JDBC and Android SQLite integrations currently use caller-provided SQL directly as the span description. If a customer interpolates values instead of using placeholders, literals and comments can contain PII, credentials, or other sensitive data and are sent to Sentry. The Java SDK has no SQL sanitizer today.

### Solution Brainstorm

Introduce a shared internal SQL analyzer used by sentry-jdbc and sentry-android-sqlite.

Requirements:
- Sanitize every statement, including prepared-statement text.
- Replace literal values with placeholders while preserving SQL structure and existing parameter markers.
- Remove or redact line and block comments.
- Handle database dialect differences conservatively.
- Never fall back to, attach, or log the original query if analysis fails; fail closed to safe structural metadata.
- Use sanitized query text as the transaction-based span description.
- Cover JDBC, SupportSQLiteOpenHelper, and SQLiteDriver instrumentation.
- Add malformed-input, dialect, secret-canary, fuzz/robustness, and performance tests.

OpenTelemetry Java's Apache-2.0 JFlex `SqlSanitizerWithSummary.jflex` is strong prior art and can likely be adapted, but should not be vendored unchanged: OTel preserves comments, may skip sanitization for prepared statements, and preserves unknown fragments. Vendoring requires source attribution and a THIRD_PARTY_NOTICES.md entry.

定位 sentry-jdbc 和 sentry-android-sqlite 的 instrumentation，包括 SupportSQLiteOpenHelper 和 SQLiteDriver 入口點，並參考 OpenTelemetry Java 的 SqlSanitizerWithSummary.jflex。完成標準是所有語句都能產生安全的結構化 span 描述，同時不暴露字面值或註解，並涵蓋格式錯誤輸入、方言、secret-canary、fuzz/穩健性和效能。

由索引模型根據 Issue 內容生成。