Enforce read-only mode by rejecting non-read SQL

[BorisTyshkevich]

Summary

This PR enforces read_only behavior in the MCP execution path by rejecting non-read SQL statements before execution.

Closes #56.

Changes

• Add a guard in Client.ExecuteQuery to reject non-read queries when ReadOnly=true.
• Keep allowed read statements aligned with existing isSelectQuery behavior (SELECT, WITH, SHOW, DESC, EXISTS, EXPLAIN).
• Add unit test coverage for read-only non-select rejection.
• Update tool/OpenAPI query parameter descriptions to reflect read-only restrictions.
• Update README --read-only flag description to clarify enforced behavior.

Validation

• gofmt -w pkg/clickhouse/client.go pkg/clickhouse/client_test.go pkg/server/server.go
• go test ./pkg/clickhouse ./pkg/server -run "TestClientErrorPaths|TestUtilityFunctions|TestHandleExecuteQuery|TestHandleExecuteQueryOpenAPI|TestBuildConfigFromClaims" -count=1