fix(rules): sql-concat rules ignore prose and identifier interpolation (#662)

[ajianaz]

Closes #662.

What

Extends the existing SQL false-positive filter (now also applied to sec-sql-concat):

• Prose is not SQL. The line must have SQL structure (SELECT..FROM, INSERT INTO, UPDATE x SET, DELETE FROM); format!("Insert failed: {e}") and format!("Deleted tag '{}'") are suppressed.
• Only a spliced value is injection. A {x} / ${x} in a value position (after =, <, >, LIKE, IN (, a quote, %, or inside a VALUES list) or "..." + value concatenation stays Critical. Identifier and fragment positions (FROM {table}, SET {cols}, {column} IS NOT NULL) and parameter indexes (?{n}) are suppressed: they cannot be bound as parameters.
• query += ... keeps being flagged whatever else is on the line.

Why

Issue #662: 5 of the 38 Critical/Major false positives found on two real codebases were these rules.

Testing

• cargo fmt --check, cargo clippy --all-targets --features tree-sitter -- -D warnings, cargo test --features tree-sitter (1220 passed). New: 4 prose lines, 5 identifier/fragment lines suppressed; 8 injection shapes (Rust format!, Python f-string, JS template, + concat, LIKE, IN, VALUES) and query += still flagged.
• Real build re-scan of uteke and uteke-cloud (Critical+Major): the 5 SQL findings are gone (uteke 20 → 15).
• Known limit: a table name taken from user input in FROM {table} is no longer reported; static analysis cannot tell, and identifiers cannot be parameterized.