TypeScript: implement Drizzle ORM sink extraction

[bjcorder]

Parent

Part of #89.

Context

Drizzle ORM is a major TypeScript SQL ORM/query builder with typed schema objects and fluent query APIs. Rulepath should detect CRUD operations, filters, update sets, transactions, and raw SQL fragments.

Reference: https://orm.drizzle.team/docs/overview

Scope

• Detect Drizzle database clients, schema table objects, relational query APIs, and common imports.
• Detect operations such as select, insert, update, delete, query.<table>.findFirst/findMany, transaction, and raw sql fragments.
• Extract resource/table/model, operation type, method, filters, mutation fields, bulk flag, spans, normalized sink expression, and transaction evidence.
• Track request-controlled route/body/query values into where, eq, and, or, inArray, update sets, insert values, and raw SQL parameters.
• Recognize tenant/object scope fields and authorization evidence.
• Treat dynamic raw SQL conservatively.

Acceptance Criteria

• Drizzle unsafe fixtures emit expected findings for unscoped access, unsafe update/insert fields, and bulk mutations.
• Safe fixtures recognize tenant-scoped where clauses and safe mapping.
• Drizzle query-builder helper calls map to filter/mutation facts with stable spans.
• Raw SQL fragments do not produce speculative high-confidence findings unless enough structure is known.

Test Plan

• Add ORM unit tests for Drizzle select/insert/update/delete/transaction/raw SQL patterns.
• Add Hono/Fastify/Drizzle fixtures for safe and unsafe cases.
• Assert JSON source IDs and sink metadata.
• Run cargo fmt --all -- --check, cargo clippy --locked --workspace --all-targets, and cargo test --locked --workspace.