feat: detect and protect if pg_grapqhl on

[zsolt-p]

Added a WARN-level security lint that fires when both:

pg_graphql extension is installed (the /graphql/v1 endpoint exists), and
the anon role has SELECT on a user-schema table
For each matching table, the lint reports the schema/table and links to the
new doc page that walks through the full Introspection Lockdown Guide
(table-level revoke, blanket revoke, default-privileges fix, graphql.resolve
revoke, and authenticated re-grant pattern).

Files

lints/0026_pg_graphql_anon_table_exposed.sql — view in lint schema; uses
pg_catalog.has_table_privilege('anon', oid, 'SELECT') gated by an EXISTS
against pg_extension
docs/0026_pg_graphql_anon_table_exposed.md — full guide (rationale, options
1–3, example, verification, quick reference, false-positive note)
test/sql/0026_pg_graphql_anon_table_exposed.sql + test/expected/0026_…out —
baseline / negative (no extension) / positive (extension + anon SELECT) /
resolution (revoke)
bin/installcheck — added -f lints/0026*.sql
test/sql/queries_are_unionable.sql + expected — added new view to the union
check
splinter.sql — regenerated via bin/compile.py
Test result: All 25 tests passed. on supabase/postgres:15.1.1.13.