docs: add security and performance review recommendations

[kpirnie]

Motivation

• Provide a concise, actionable review of security risks and performance improvements for the Database class (identifier interpolation, raw WHERE fragments, logging exposure, profiling growth, SQLite tuning, connection strategy) to guide safer and faster changes.

Description

• Add SECURITY_PERFORMANCE_REVIEW.md containing prioritized security hardening items (identifier validation/allowlists, trusted-only where fragments, sanitized production logs, least-privilege DB accounts), performance guidance (gate verbose logs, query-log caps, configurable SQLite pragmas, connection benchmarking), portability/correctness notes, a rollout plan, and an operational checklist.

Testing

• Attempted to run the test suite with composer test, but it failed with phpunit: not found (exit code 127), so no unit tests were executed in this environment.

---

Codex Task