fix: prevent SQL injection in overwrite.c

[devin-ai-integration]

Fix SQL injection vulnerability identified in security scanning alert #29 by implementing SQLite parser-based validation.

Changes:

• Replace string-based SQL validation with SQLite's built-in parser
• Use sqlite3_prepare_v2() to parse and validate SQL syntax
• Verify single-statement queries using pzTail parameter
• Ensure only read-only (SELECT) statements are allowed via sqlite3_stmt_readonly()
• Support flexible column naming (col/column and val/value)
• Validate presence of required columns with naming variants
• Make timestamp column optional to maintain compatibility
• Add proper error handling and statement cleanup
• Maintain existing error flow and default query fallback

The changes are minimal and focused on security, avoiding any build system modifications. The implementation balances security with existing functionality by supporting multiple column naming conventions and making the timestamp column optional.

Testing:

• Validates proper SELECT statements with required columns
• Supports both "col"/"column" and "val"/"value" column names
• Maintains compatibility with --no-timestamp flag
• Rejects multi-statement SQL injection attempts
• Prevents non-SELECT statements
• Maintains backward compatibility with existing queries
• Proper cleanup of SQLite resources

Link to Devin run: https://app.devin.ai/sessions/7bc67faddc4d4c96ad62208b48c20218

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR
• Look at CI failures and help fix them

⚙️ Control Options:

• Disable automatic comment and CI monitoring

Add "(aside)" to your comment to have me ignore it.