fix(schema-engine): read a connection string as its flavour when sanitizing it
Which syntax a connection string is written in cannot be inferred from the string
itself: `SQLSERVER://host;database=x;password=secret` is a perfectly good URL
whose entire property list parses as an opaque host, so a URL sanitizer hands the
password straight back, and the scheme check that was meant to catch it only
matched lower case. The flavour decides instead, the way it does for comparing
two connection strings, and every caller knows it.
SQL Server strings are read as JDBC whatever the case of their scheme, and SQLite
strings are read as the file paths they are — a bare path is no URL, and used to
render as the unparseable-connection-string placeholder even though a path holds
nothing to hide.
Signed-off-by: Alexey Orlenko's AI Agent <robot@aqrln.net>