Remove SQL verb/keyword blocklists from Cosmos item query validation

Background

In #3202 the MySQL and PostgreSQL database query tools were marked Destructive = true, Idempotent = false, ReadOnly = false, and the keyword/verb blocklists were removed from their validators. The rationale: the signed-in user's database permissions are the authority on what a statement may do, and heuristic blocklists produce false positives on legitimate queries while being trivially bypassable.

cosmos item query should get the same treatment.

Current behavior

tools/Azure.Mcp.Tools.Cosmos/src/Validation/CosmosQueryValidator.cs (called from ItemQueryCommand.cs:40) rejects queries based on:

• BlockedPatterns identifier blocklist — exec, execute, trigger, sproc, storedprocedure, call, plus any token starting with sp_. This rejects legitimate queries against containers or properties with those names (e.g. SELECT c.call FROM c, SELECT * FROM sp_records).
• SELECT-only enforcement — core.StartsWith("select").
• Tautology detection — TautologyIdentifierPattern, TautologyStringLiteralPattern, TautologyBooleanPattern reject OR 1=1, OR 'x'='x', OR true. These are legitimate constructs in a query the caller authored themselves; there is no untrusted concatenation happening here.

The validator's own doc comment already concedes the stored-procedure blocklist is redundant:

Note: Stored procedures and triggers are executed via SDK APIs, not SQL queries, so they cannot be invoked through this query interface. This is defense-in-depth validation.

Proposed change

Reduce CosmosQueryValidator to structural checks only:

• Empty / whitespace-only query
• Max query length (currently 5,000 chars)
• SQL comments (--, /*)
• Multiple / stacked statements

Remove BlockedPatterns, the sp_ prefix check, the SELECT-only start check, and the three tautology regexes. Rename EnsureReadOnlySelect to something accurate (the MySQL/PostgreSQL change used ValidateQuery).

Open question

Cosmos SQL is genuinely read-only — unlike MySQL/PostgreSQL, there is no DML surface to expose. So ItemQueryCommand can likely keep ReadOnly = true / Destructive = false even after the blocklists are removed. Worth confirming during implementation rather than reflexively copying the MySQL/PostgreSQL metadata change.

Checklist

• Trim CosmosQueryValidator to structural checks
• Update CosmosQueryValidatorTests.cs (currently ~60 assertions, many covering removed behavior)
• Confirm whether command metadata needs to change
• Update servers/Azure.Mcp.Server/docs/azmcp-commands.md if the description or metadata flags change
• Add a changelog entry under servers/Azure.Mcp.Server/changelog-entries/ (.yml, not .md — Compile-Changelog.ps1 only globs *.yaml/*.yml)