Update Postgres function definition of datadog.explain_statement to use a read-only transaction

[dujuku]

What does this PR do?

Ensures the datadog.explain_statement statement executes with read-only transaction state. While this change does not affect the behavior of the Agent (only the test data is changed), the function definition will be modified in the documentation to match this.

Documentation PR: DataDog/documentation#31654

Motivation

There is no known vulnerability to execute the query passed to the function or escape the EXPLAIN command, however this mitigates the blast radius if such a vulnerability is discovered.

Review checklist (to be filled by reviewers)

• Feature or bugfix MUST have appropriate tests (unit, integration, e2e)
• Add the qa/skip-qa label if the PR doesn't need to be tested during QA.
• If you need to backport this PR to another branch, you can add the backport/<branch-name> label to the PR and it will automatically open a backport PR once this one is merged

[github-actions]

⚠️ Recommendation: Add qa/skip-qa Label

This PR does not modify any files shipped with the agent.

To help streamline the release process, please consider adding the qa/skip-qa label if these changes do not require QA testing.

[jasonmp85]

Looks good to me.

[jasonmp85]

Alternative to this, we could:

• Change the function to be SECURITY INVOKER, so someone running it with low privileges is necessarily limited to those privileges (rather than running as the creator of the function)
• Change the creator of the function to be a user that is read-only

However, this change seems the quickest for now; I think it makes sense to ship this.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 89.25%. Comparing base (df8de38) to head (512c4b6).

Additional details and impacted files

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[AAraKKe]

@dujuku I just relaunched the test that failed since this PR has some time already. Just want to see if it is a flake.

As a side note, please avoid using the no-changelog label. As you can see, after removing it, the job does not complain because this is not a PR worth of a changelog. By using the label we can miss PRs that need a changelog and do not have it.

Anything that is shipped with the agent needs to have a changelog and when we have a PR without one this delays the release process.

Thanks a lot!