security: suppress CodeQL clear-text-logging false positive on the fixed line

CodeQL's default query pack doesn't model first-party functions as
sanitizers, so it keeps flagging the logger.error(...) call in
_execute_with_connection even after both arguments are routed through
obfuscate_password (the actual fix, landed in 038b5dd/cca7e50) -- the
static analyzer can't trace that the returned value is safe.

Suppressed with an inline `# codeql[py/clear-text-logging-sensitive-data]`
comment, following the exact convention already used in this repo
(tests/unit/test_secrets.py:234) -- GitHub's own supported suppression
syntax, not a custom workaround. The comment documents why it's safe:
the redaction is verified by tests/unit/test_sql_kernel_{obfuscate,
driver}.py, including the SQL-escaped-embedded-quote edge case
independently corroborated by gemini-code-assist's review on this PR.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01ESh2w9n8kzbLskHoq9w2UH

Author: devopam

src/mcpg/sql/driver.py

@@ -296,6 +296,12 @@ async def _execute_with_connection(  # pragma: no cover - real psycopg execution
             # alert #5).
             logger.error(
                 "Error executing query (%s): %s",
+                # codeql[py/clear-text-logging-sensitive-data]: obfuscate_password
+                # IS the sanitizer for this taint flow -- CodeQL's default query
+                # pack doesn't model first-party functions as sanitizers, so it
+                # keeps flagging the pre-sanitization taint even after the fix.
+                # Verified redacted (including the SQL-literal-with-embedded-quote
+                # edge case) in tests/unit/test_sql_kernel_{obfuscate,driver}.py.
                 obfuscate_password(str(query)),
                 obfuscate_password(str(e)),
             )