chore(deps): bump ClickHouse driver to 2.42.0

[arun-k-bharathan]

Summary

github.com/ClickHouse/clickhouse-go/v2 2.40.3 → 2.42.0, replacing #115.

Only go.mod and go.sum changed, but the transitive footprint is wide: 48 insertions and 48 deletions across the two files, including golang.org/x/net 0.47.0 → 0.48.0, golang.org/x/text 0.31.0 → 0.32.0, ClickHouse/ch-go 0.68.0 → 0.69.0, paulmach/orb 0.11.1 → 0.12.0 and OpenTelemetry 1.38.0 → 1.39.0.

govulncheck ./... reports the same 14 reachable vulnerabilities as main, so nothing here is a security fix.

What changes at runtime, without any code change here

No Go file changes in this PR. The three items below are changes the driver authors made between 2.40.3 and 2.42.0, and they take effect as soon as the version moves. I'm listing them because this is a measurement tool, so driver defaults land in the numbers it reports, and because internal/clickhouse/clickhouse.go:93 calls clickhouse.OpenDB(opt) with no pool configuration of its own, which is what makes the first two bite.

Pool settings are now applied. 2.40.3's OpenDB never called db.SetMaxIdleConns and friends. 2.42.0 calls all three unconditionally from opt.setDefaults() (clickhouse_std.go:158), and those defaults are 5 idle, 10 open, and a one hour connection lifetime (clickhouse_options.go:376). Every worker owns its own *sql.DB, so a soak test running longer than an hour will see workers reconnect mid-run, which lands in the HdrHistogram as latency belonging to the driver rather than to the server.

HTTP transport compression is off by default. 2.42.0 sets DisableCompression: true on the default transport (conn_http.go:257), which 2.40.3 did not. That moves bytes on the wire, CPU, and therefore throughput for anyone using the HTTP protocol.

Object('JSON') support is gone. The implementation in lib/column/object_json.go is commented out in its entirety in 2.42.0, and the driver's own note there says the replacement native JSON type is not supported yet. A target schema using either type has no working path.

The internal/clickhouse tests run against sqlmock rather than a real connection, so CI covers none of this.

Merge order

This branch does overlap the other cleanup PRs. It moves golang.org/x/net, x/text, x/crypto, x/sync and x/sys, all of which #126 moves further, so whichever of the two merges second will need a go.mod conflict resolved. MVS takes the higher version either way, so the order is a matter of convenience rather than correctness.

I'd still suggest merging this one last, after #125, #126 and #127. It's the only PR in the cleanup that shifts runtime behaviour, and keeping it at the end makes it cheap to isolate or revert.

Please close #115 after merging this one, since I'm working from a fork and can't close it myself.

Test plan

• go build ./...
• make test (go test -count=1 -race ./...), all 13 test packages pass
• make lint matches the main baseline at 238 findings, none new
• CI on this PR
• A smoke test against a real ClickHouse server. The changes above are invisible to the sqlmock tests, and I have not run one.