Draft: v2/postgres: select databases and roles from the infrastructure contract

⚠️ Experiment, not to be merged. Part of the Relay-on-Theseus PoC (Refs gitlab-org/cluster-integration/gitlab-agent#1082). The findings are summarized in Relay on Theseus: what's missing.

Lets a LabKit v2 service open any database listed in the infrastructure contract's postgresql_databases with postgres.WithDatabase and postgres.WithRole: per-identifier and per-role Secret trees, atomic credential pairing, direct endpoints for roles, sslmode and TLS file parameters in the DSN, and a secret.Has presence check so a pooled endpoint is never silently bypassed. The singular contract form behaves exactly as before.

MRs of this work:

• Draft: Add a Relay container image with the GLAZ engine linked in (gitlab-org/cluster-integration/gitlab-agent!4313 (merged))
• Draft: Add a Fairway-generated Helm chart for Relay (gitlab-org/cluster-integration/gitlab-agent!4315 (closed))
• Draft: Add a Relay fragment with AutoFlow on CNPG (gitlab-caproni!108 (closed))
• Draft: Add identified PostgreSQL databases, roles, and TLS to gitlab.infrastructure.v1 (protos!38 (closed))
• Draft: Mount several PostgreSQL databases, roles, and TLS Secrets from the infrastructure contract (gitlab-com/gl-infra/platform/runway/fairway!217)
• Draft: v2/postgres: select databases and roles from the infrastructure contract (!666 (closed))
• Draft: Read autocore's databases from the Theseus infrastructure contract (gitlab-org/cluster-integration/gitlab-agent!4317)
• Draft: Declare several CloudSQL databases on a deployment and render them through one proxy sidecar (gitlab-com/gl-infra/platform/runway/runwayctl!1958)
• Draft: Switch the Relay chart to the infrastructure contract (gitlab-org/cluster-integration/gitlab-agent!4318)
• Draft: OAK: add GitLab Relay as a component (omnibus-gitlab!9742 (closed))
• Draft: Document running Relay through OAK on a Linux package (gitlab-org/cluster-integration/gitlab-agent!4319)