Enforce centralized SQLite connection creation (#35828)

## Why

Direct SQLx constructors can bypass the shared SQLite configuration in
`codex-state`.

## What changed

- Deny SQLx pool, connection, and database creation methods through the
  workspace Clippy configuration for both Cargo and Bazel builds.
- Exempt `codex-rs/state/src/sqlite.rs`, the centralized connection shim, from
  the lint.
- Document that the deny list must be audited when upgrading SQLx.

GitOrigin-RevId: e20d7e83095727ac446347157782175062a100fc

codex-rs/state/src/sqlite.rs

@@ -1,5 +1,10 @@
 //! Shared SQLite connection configuration.
 
+#![expect(
+    clippy::disallowed_methods,
+    reason = "this is the centralized SQLite connection shim"
+)]
+
 use crate::DbTelemetry;
 use crate::migrations::repair_legacy_recency_migration_version;
 use crate::runtime::RuntimeDbInitError;