omdb could more safely support "write" commands

illumos debugging tools like DTrace and MDB have a distinction between ordinary operations, which are generally read-only and safe, and "destructive" operations, which may modify the thing you're debugging or otherwise pose some risk. I think this has proved a really successful model that we could use in omdb as well. By default it should do no harm. We could add other commands behind a top-level -w/--destructive flag.

It could be a little risky to do this purely by convention. But I wonder if we could enforce it pretty well if:

• Could we add to progenitor a way to create a read-only client, that could only perform GET/HEAD operations?
• For the database connection pool, I wonder if we could add a mode that runs set default_transaction_read_only = on when establishing connections so that write operations would be rejected by the server? We'd want to test this out -- I'm not clear from the docs if this applies to implicit transactions or just those created with BEGIN TRANSACTION

If these both work out, we'd only have to check for the destructive flag in a few places where we create clients and the connection pool, instead of relying on everybody to check this whenever they add new commands.

Begin by locating omdb's client creation, progenitor integration, and database connection-pool setup. Read the CockroachDB transaction-read-only documentation and test whether the proposed setting applies to implicit transactions. The work is done when the design is settled and read-only behavior, the destructive flag, and rejected writes are covered by tests.