Remove df.debug_connection(); reclassify #110 as non-security cleanup

[crprashant]

Summary

Removes df.debug_connection() from the pg_durable SQL surface and reclassifies issue #110 from a security finding to non-security cleanup.

df.debug_connection() returned the worker connection string postgres://<role>@<host>:<port>/<db> — no password or credential. The worker role it exposed is already world-readable through native PostgreSQL channels (the pg_durable.worker_role GUC and pg_stat_activity.usename), and the remaining fields (database, host/port, schema) are connection-topology metadata, not secrets. The function disclosed nothing that isn't already available, so removing it is surface reduction — not a vulnerability fix.

Closes #110.

Rebased onto main after #242 merged. See Relationship to #242 below for why the change set is now smaller than the original.

What changed

• Drop the function from the SQL surface: the 0.2.3 → 0.2.4 upgrade script (sql/pg_durable--0.2.3--0.2.4.sql) DROPs it, and fresh installs never emit it.
• Binary backward-compat shim (src/dsl.rs): the Rust #[pg_extern] is annotated sql = false, so fresh installs create no CREATE FUNCTION, but the underlying C wrapper symbol (debug_connection_wrapper) stays in the .so. Pre-0.2.4 schemas (which still carry CREATE FUNCTION ... 'debug_connection_wrapper') keep resolving the symbol until the customer runs ALTER EXTENSION pg_durable UPDATE. No runtime behavior changes — the background worker builds its connection from an internal Rust helper, not this SQL function.
• Unit test (src/lib.rs): the old test_debug_connection_returns_info (which called the now-removed function) is replaced by test_connection_info_builders, which exercises the postgres_connection_string() / backend_duroxide_schema() builders directly.
• Docs: CHANGELOG.md (new ### Removed entry), docs/security-review/security-review.md (I-7 reclassified Medium → Info / ✅ Resolved, recommendation 6 struck through as superseded), docs/security-review/workbook-data.md (function row removed), docs/upgrade-testing.md (v0.2.3→v0.2.4 Security: restrict df.debug_connection() and redact connection info from PG logs #110 notes covering symbol retention, the dependent-object RESTRICT behavior, and a PROVIDER_COMPAT_START_VERSION shim-removal reminder).

Relationship to #242 (already merged)

This PR sits on top of #242, which simplified df.grant_usage() / df.revoke_usage() by removing their per-function EXECUTE allowlist (func_sigs). The original version of this PR also edited that allowlist to drop 'df.debug_connection()' from it — but #242 removed the whole allowlist, so that edit is now obsolete. As a result:

• The upgrade simply DROPs the function; no grant_usage change is needed to account for the removal.
• src/lib.rs carries only the unit-test change above — its grant_usage body is Simplify df.grant_usage/df.revoke_usage privilege helpers #242's, untouched here.

Testing

• Upgrade suite (scripts/test-upgrade.sh): 36/36, including a new B2 regression test — after ALTER EXTENSION UPDATE, df.debug_connection() is absent and the simplified df.grant_usage() still runs cleanly and actually grants a privilege against the upgraded schema.
• E2E (tests/e2e/sql/18_delegated_grants.sql): added a fresh-install assertion that df.debug_connection() is never created. Full suite green except one unrelated, pre-existing failure (45_connection_limit_timeout) that is fixed separately in Implement full UUID instance/node IDs (#129) #238.
• cargo fmt --check, build, clippy (no new warnings), and unit tests (170 passed) all green.

Upgrade & compatibility

• Scenario A (fresh == upgraded): schema comparison passes — the function is absent on both paths.
• Scenario B1 (new .so vs old 0.2.2 / 0.2.3 schemas, no UPDATE): passes — the debug_connection_wrapper C symbol is retained by the sql = false shim.
• Scenario B2 (data after UPDATE): passes.
• The upgrade DROP FUNCTION IF EXISTS df.debug_connection() uses default RESTRICT; if a customer object depends on the function the upgrade aborts with a dependency error (intentional — no CASCADE).