refactor(security): move all database access into pkg/security/lookup

pkg/security no longer contains SQL. Every provider calls a store interface
from lookup, implemented by a procedure backend (Postgres stored procedures,
the default there) and a direct backend (dialect-driven SQL for postgres,
sqlite, mysql and mssql with configurable table and column names).

- add sectypes, lookup, lookup/{dialect,procedure,direct,backends,ddl,conformance}
- split totp and providers sub packages out of the core package
- replace SQLNames/TableNames/QueryMode with lookup.Config (see breaking_changes.md)
- direct backend now covers column/row security and API-key login
- move txsettings SQL to lookup.ApplyTxSettings; remove password.go
- move schema scripts under lookup/, add reference DDL per dialect
- add a shared conformance suite; run it on sqlite, and on Postgres in a
  podman/docker container (RESOLVESPEC_TEST_CONTAINERS=1)
- fix procedure schema bugs found on real Postgres: duplicate p_data
  parameter, JSON null arrays, expires_at timezone casts, passkey list
  GROUP BY, missing resolvespec_passkey_login; accept zone-less timestamps

pkg/security/lookup/direct/helpers_test.go

@@ -0,0 +1,46 @@
+package direct
+
+import (
+	"database/sql"
+	"testing"
+
+	_ "github.com/glebarez/go-sqlite"
+
+	"github.com/bitechdev/ResolveSpec/pkg/security/lookup"
+	"github.com/bitechdev/ResolveSpec/pkg/security/lookup/ddl"
+	"github.com/bitechdev/ResolveSpec/pkg/security/lookup/dialect"
+	"github.com/bitechdev/ResolveSpec/pkg/security/lookup/procedure"
+)
+
+func newTestDB(t *testing.T, extraDDL ...string) *sql.DB {
+	t.Helper()
+	db, err := sql.Open("sqlite", ":memory:")
+	if err != nil {
+		t.Fatal(err)
+	}
+	db.SetMaxOpenConns(1)
+	t.Cleanup(func() { _ = db.Close() })
+	ref, err := ddl.SQL("sqlite")
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, s := range append([]string{ref}, extraDDL...) {
+		if _, err := db.Exec(s); err != nil {
+			t.Fatalf("ddl: %v", err)
+		}
+	}
+	return db
+}
+
+func newTestBase(t *testing.T, db *sql.DB, schema lookup.Schema) *Base {
+	t.Helper()
+	d, err := dialect.Detect(db)
+	if err != nil {
+		t.Fatal(err)
+	}
+	b, err := NewBase(procedure.NewDB(db, nil, nil), d, schema)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return b
+}