Fix high-severity issues: implement SSL and warn on raw-SQL filter

SSL was wired through the UI and ConnectionProfile but never actually
applied in any driver or passed from the connection builder.

- main_window: pass ssl/ssl_ca/ssl_cert/ssl_key from profile into
  the driver config dict so drivers can act on them
- MySQL: add ssl={ca,cert,key} to pymysql connect kwargs when enabled
- PostgreSQL: set sslmode=verify-ca (with CA) or require, plus
  sslrootcert/sslcert/sslkey when provided
- MSSQL: switch Encrypt=yes + TrustServerCertificate=no when SSL is
  on; Encrypt=no + TrustServerCertificate=yes otherwise
- SQLite: no change needed (local file, no network layer)

WHERE filter: add tooltip explicitly labelling the input as raw SQL
so users understand arbitrary expressions are executed directly.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

app/main_window.py

@@ -246,6 +246,10 @@ class MainWindow(QMainWindow):
             "user":               profile.username,
             "password":           profile.password,
             "connection_timeout": profile.connection_timeout,
+            "ssl":                profile.ssl,
+            "ssl_ca":             profile.ssl_ca,
+            "ssl_cert":           profile.ssl_cert,
+            "ssl_key":            profile.ssl_key,
         }
         _log.info("Connecting to '%s'  type=%s  host=%s",
                   profile.name, profile.db_type, profile.host)