fix(io-manager): create primary key if missing

[hbruch]

This PR creates missing primary keys for tables which were created before primary keys were created in conjuction with newly created tables.

[derhuerst]

AFAICT this creates the potential for an SQL injection vulnerability! ⚠️ – We don't know if and how _has_primary_key() will ever be used in a different context or without knowing if its arguments are user-defined.

Instead, psycopg's docs recommend passing the literals as additional arguments into execute().

[hbruch]

You are right. While this should be avoided by the explicit call to self._assert_sql_safety(schema, table) right before, at this place this is not required and can be done via parameter passing, as it's not an DDL statement. Will change this.

[derhuerst]

In almost all cases, I don't see any reason to manually check for SQL safety, as the DB client should always (and psycopg2 does in this case!) provide means to send the values as arguments to the DB server.

To use SQL identifiers dynamically, psycopg2 also provides a tool:

If you need to generate dynamically SQL queries (for instance choosing dynamically a table name) you can use the facilities provided by the psycopg2.sql module:

---

There should also be a linting rule forbidding string interpolation with SQL queries.

[derhuerst]

Haven't tested the code, but the changes look reasonable.