ClickHouse SELECT ... INTO OUTFILE (and the INTO FILE alias) writes
query output to a server-side file path, a data-movement side effect
outside read-only monitoring. The sql-validator denylist had no
clause for it, so a SELECT that starts with SELECT (and thus passes
the statement-type gate) could carry an INTO OUTFILE write through.

Add an INTO_FILE_WRITE pattern to SQL_PATTERNS and wire it into
SQL_INJECTION_PATTERNS. It scans the literal-blanked copy so a
LIKE '%INTO OUTFILE%' audit query is not mis-flagged, while the real
clause tokens (which sit outside a literal) are still blocked.

Closes #3222

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Co-Authored-By: duyetbot <bot@duyet.net>