fix(cubejs): propagate team/member properties into SQL API scope

[acmeguy]

Summary

• Populate `teamProperties` and `memberProperties` in the security context built for the SQL API (`checkSqlAuth.js → buildSqlSecurityContext`).
• Unblocks `queryRewrite` rule evaluation on SQL wire logins (Postgres/MySQL). Without this, every rule's property lookup returns `undefined`, `blocked` fires, and the query is rewritten to the `blocked_by_access_control` sentinel — which then crashes downstream when the first member is a numeric measure.

Reproduction

```
psql -h dbx.fraios.dev -p 15432 -U -d db -c 'SELECT count(*) FROM stockout_event'
```

Failed with:

```
ERROR: Cannot parse string 'blocked_by_access_control' as Float64
In scope SELECT count(*) AS stockout_event__count FROM (...)
```

A rule for `semantic_events.partition` with `property_source: team` tries to read `teamProperties.partition`, which was `undefined` because `buildSqlSecurityContext` never populated it. `queryRewrite` blocks and replaces `query.filters` with:

```
[{ member: allMembers[0], operator: "equals", values: ["blocked_by_access_control"] }]
```

`allMembers[0]` is `stockout_event.count` (numeric) → ClickHouse cast failure.

Fix

`buildSqlSecurityContext` now mirrors `defineUserScope`:

• Resolves the member for the datasource's team via `sqlCredentials.user.members`.
• Passes `team.settings` and `member.properties` into the scope.
• Also threads `teamSettings` into `buildSecurityContext` so the content-hash isolates cache consistently between REST and SQL paths.

Test plan

• `psql -h dbx.fraios.dev -p 15432 -U -d db -c 'SELECT count(*) FROM stockout_event'` returns a row count without cast error.
• Rule-based row filtering still scopes SQL queries to the team's partition (verify via query plan shows `partition = 'bonus.is'`).
• Wrong password still returns 28P01.
• REST /load path remains unchanged.

🤖 Generated with Claude Code