feat: add support for FORCE ROW LEVEL SECURITY

[tianzhou]

Implements PostgreSQL's FORCE ROW LEVEL SECURITY feature, which applies row-level security policies even to table owners and superusers.

Changes:

• Added RLSForced boolean field to IR Table struct
• Updated database queries to fetch relforcerowsecurity from pg_class
• Extended diff logic to track ENABLE and FORCE changes independently
• Added SQL generation for FORCE/NO FORCE ROW LEVEL SECURITY statements
• Created dedicated test case for FORCE RLS functionality
• Updated fingerprints in existing policy tests to account for new IR field

Test coverage:

• New test: create_policy/force_rls - validates FORCE RLS detection and migration
• All 9 policy integration tests passing
• Both diff and plan/apply tests validated

Fixes #214

🤖 Generated with Claude Code

[Copilot]

Pull request overview

This PR implements support for PostgreSQL's FORCE ROW LEVEL SECURITY feature, which applies RLS policies even to table owners and superusers. The implementation adds a new RLSForced boolean field to track this state alongside the existing RLSEnabled field, updates database queries to fetch the relforcerowsecurity column, and extends the diff/migration logic to handle ENABLE/FORCE changes independently.

Key changes:

• Added RLSForced field to the IR Table struct to track forced RLS state
• Updated database queries to fetch both relrowsecurity and relforcerowsecurity from pg_catalog.pg_class
• Modified diff logic to handle ENABLE and FORCE RLS changes as separate, independent operations using pointer fields to distinguish between "no change" and "change to false"

Reviewed changes

Copilot reviewed 21 out of 21 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
testdata/diff/create_policy/force_rls/*	New test case validating FORCE RLS detection and migration from enabled-only to enabled-and-forced state
testdata/diff/create_policy/*/plan.json	Updated fingerprint hashes to account for new RLSForced field in IR
ir/ir.go	Added RLSForced boolean field to Table struct
ir/queries/queries.sql	Modified RLS table queries to fetch relforcerowsecurity and changed to use pg_catalog.pg_class instead of pg_tables
ir/queries/queries.sql.go	Generated code reflecting query changes, including simplified parameter types
ir/inspector.go	Updated buildRLSPolicies to set both RLSEnabled and RLSForced from query results
internal/diff/diff.go	Modified rlsChange struct to use pointer fields for Enabled and Forced to distinguish no-change from change-to-false
internal/diff/policy.go	Extended generateRLSChangesSQL to handle both ENABLE/DISABLE and FORCE/NO FORCE statements independently
internal/diff/table.go	Updated diff detection and SQL generation logic to track and generate both ENABLE and FORCE changes

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.