Expose SQLite's connection authorizer through database/sql

SQLite provides sqlite3_set_authorizer, and modernc includes the underlying SQLite primitive, but the Go driver does not expose a supported way to install an authorizer on a physical connection.

I have a use case that fits the authorizer particularly well, because enforcement happens inside SQLite during statement compilation, including automatic reprepare.

database/sql.Conn.Raw gives access to the physical driver connection, but the SQLite handle and translated-C state required to call sqlite3_set_authorizer are private to the package. So this cannot be implemented cleanly outside the driver without modifying modernc or relying on unsupported internals.

This is also a capability the driver's own _defensive hardening documentation currently notes as absent. Exposing it does not by itself make untrusted database files safe; callers still need to configure an appropriate policy and SQLite's other recommended defenses.

I have opened a Draft MR with a working implementation and tests. It follows the same general Conn.Raw pattern as other SQLite-specific capabilities in the package. The implementation is small; most of the diff is test coverage for installation, replacement/removal, OK/DENY/IGNORE, prepared-statement reprepare, pool reuse, close cleanup, and race behavior.

There is no behavior change unless an authorizer is explicitly registered, and no generated SQLite source is modified.

The patch is meant as evidence of feasibility and must be viewed as a working proposal. I am happy to modify or reshape it to accommodate the project if you decide this is worth pursuing.

For transparency: I worked out the requirement and reviewed the design and implementation, but I used OpenAI Codex to write much of the patch and tests. I reviewed the resulting diff and validation and I am responsible for the submission.

Draft MR: !139 (merged)

Would you be open to exposing this capability?