Add sqlglot drift tripwires for common.ai read-only SQL validation

[Lee-W]

Why

apache-airflow-providers-common-ai has no upper bound on sqlglot. If an upstream release renames, splits or removes an exp expression class that utils/sql_validation.py references, the read-only check could silently stop recognising a write statement and let it through. A failure at that point should show up in CI, not in production.

What

Adds a TestSqlglotDriftTripwires test class. When one of its tests fails after a sqlglot bump, the message points at _DATA_MODIFYING_NODES / DEFAULT_ALLOWED_TYPES in utils/sql_validation.py for review.

• No allowed type overlaps (is a parent or child of) a data-modifying type.
• Each write statement (insert, update, delete, merge, drop, truncate, create, CREATE ... AS SELECT, alter, CTE-wrapped DELETE / INSERT, SELECT ... INTO) still parses to the node class named in the deny-list, in postgres, mysql, snowflake, bigquery and sqlite.
• Write and DDL statements, including COPY and GRANT, are rejected in all five dialects with allow_read_only_metadata on and off, and each case pins whether the top-level type check or the deep scan rejects it. DESCRIBE ALTER and EXPLAIN DELETE are rejected by the deep scan in metadata mode.
• Each write statement (insert, update, delete, merge, drop, truncate, create, CREATE ... AS SELECT, alter, CTE-wrapped DELETE / INSERT / MERGE, SELECT ... INTO) still parses to the node class named in the deny-list, in postgres, mysql, snowflake, bigquery and sqlite.
• Write and DDL statements, including COPY and GRANT, are rejected in all five dialects with allow_read_only_metadata on and off, and each case pins whether the top-level type check or the deep scan rejects it. DESCRIBE ALTER, DESCRIBE ALTER SYSTEM (parsed as exp.Command) and EXPLAIN DELETE are rejected by the deep scan in metadata mode.

---

Was generative AI tooling used to co-author this PR?

• Yes (please specify the tool below)

Generated-by: [Claude] following the guidelines

---

• Read the Pull Request Guidelines for more information. Note: commit author/co-author name and email in commits become permanently public when merged.
• For fundamental code changes, an Airflow Improvement Proposal (AIP) is needed.
• When adding dependency, check compliance with the ASF 3rd Party License Policy.
• For significant user-facing changes create newsfragment: {pr_number}.significant.rst, in airflow-core/newsfragments. You can add this file in a follow-up commit after the PR is created so you know the PR number.

[developer-rpai]

Nice defensive work — an unpinned sqlglot silently reclassifying a write as a read would be a nasty failure mode, and tripwires are the right belt-and-suspenders.

A few observations:

1. The tests import _DATA_MODIFYING_NODES (underscore-private) from sql_validation. If a refactor renames that constant — exactly the drift this guards — the tests fail at import time rather than with a useful message. Testing through the public parse_sql/collect_table_references API would keep the tripwire semantics without the private coupling.
2. _DIALECTS covers postgres/mysql/snowflake/bigquery/sqlite, but the write-denial parse assertions only run under postgres. MERGE/COPY/SELECT ... INTO parse trees differ by dialect — worth parametrizing at least the dialect-sensitive statements.
3. On the overlap test: if sqlglot renames a denied class, the old name fails test (a) first anyway, so the failure ordering is sensible — a one-line comment noting that would save the next reader some puzzling.
4. Scope question: the root cause named in the comment block is the missing upper bound on sqlglot in pyproject.toml. Tripwires are good, but is an upper-bound pin also wanted?