rust: Add config-derived table name barrier for SQL injection

[chanel-y]

Description

This PR adds a  ConfigDerivedTableNameBarrier  to the Rust SQL-injection query. It treats reads of struct fields whose names denote a database identifier — matching  (?i).*(table|collection|schema|bucket|index|view)(_name)?$  — as taint barriers. These fields are, by convention, populated at service startup from hardcoded strings or configuration rather than from per-request user input, so interpolating them into a query string is not user-controlled SQL injection.

False positives eliminated

All three alerts come from the same  delete_aggregate  method in  Nexus.Foundation/crates/nexus-persistence/src/es/store.rs . In each case the only value interpolated into the SQL text is an internal table-identifier field ( self.events_table ,  self.snapshots_table ,  self.view_table ), while the sole request-derived value ( aggregate_id ) is safely parameterized with  .bind(...)  /  $1 .

The table-identifier fields are initialized once from the aggregate type name (a compile-time/config constant), never from request data:

// AggregateTableConfig::new(aggregate_name) — service setup, not request data
Self {
events_table: format!("{}_events", aggregate_name),
snapshots_table: format!("{}_snapshots", aggregate_name),
view_table: format!("{}_view", aggregate_name),
}

1.  store.rs:74  —  events_table 

Alert: https://codeql.microsoft.com/issues/85f36f3f-1401-45a7-a1d6-ea277c2f4933?Campaign=5272e251cdc44e9eaa056e5b1c1a1c06

if let Err(e) = sqlx::query(&format!(
"DELETE FROM {} WHERE aggregate_id = $1",
self.events_table // internal identifier — the only {} filler
))
.bind(aggregate_id) // request value — parameterized as $1
.execute(pool)
.await

2.  store.rs:91  —  snapshots_table 

Alert: https://codeql.microsoft.com/issues/a3e7f634-5aee-4bfc-b242-d7cd453021be?Campaign=5272e251cdc44e9eaa056e5b1c1a1c06

if let Err(e) = sqlx::query(&format!(
"DELETE FROM {} WHERE aggregate_id = $1",
self.snapshots_table // internal identifier — the only {} filler
))
.bind(aggregate_id) // request value — parameterized as $1
.execute(pool)
.await

3.  store.rs:108  —  view_table 

Alert: https://codeql.microsoft.com/issues/cd77a610-9abb-4125-b138-51d04b4fd1a9?Campaign=5272e251cdc44e9eaa056e5b1c1a1c06

let result = sqlx::query(&format!(
"DELETE FROM {} WHERE view_id = $1",
self.view_table // internal identifier — the only {} filler
))
.bind(aggregate_id) // request value — parameterized as $1
.execute(pool)
.await?;

Why this fixes the false positives

CodeQL reports these because its taint tracking follows values into the  format!  →  sqlx::query  sink. But the only value spliced into the SQL structure is a table identifier read from an internal struct field ( self.events_table  etc.), which is a  FieldExpr  whose identifier ends in  table / view . The new  ConfigDerivedTableNameBarrier  marks such field reads as barriers, so the config-derived identifier no longer taints the query. The request-controlled  aggregate_id  is unaffected — it is already safe because it is bound as  $1  rather than concatenated.