Fix invalid UTF-8 handling in SQLite parser

Port gwenn/lemon-rs@14f422a to replace the unchecked UTF-8 conversion with a lossy conversion. Bump the vendored parser to 0.13.1 and add regression coverage for invalid input.\n\nAddresses CVE-2025-47736 / GHSA-8m95-fffc-h4c5.

Author: tszymczyszyn-shopify

Cargo.lock

@@ -1,6 +1,6 @@
 [package]
 name = "libsql-sqlite3-parser"
-version = "0.13.0"
+version = "0.13.1"
 edition = "2021"
 authors = ["gwenn"]
 description = "SQL parser (as understood by SQLite) (libsql fork)"

vendored/sqlite3-parser/Cargo.toml

@@ -58,7 +58,7 @@ impl TokenType {
 }
 
 fn from_bytes(bytes: &[u8]) -> String {
-    unsafe { str::from_utf8_unchecked(bytes).to_owned() }
+    String::from_utf8_lossy(bytes).to_string()
 }
 
 include!(concat!(env!("OUT_DIR"), "/keywords.rs"));
@@ -403,3 +403,13 @@ impl TokenType {
         }
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::from_bytes;
+
+    #[test]
+    fn converts_invalid_utf8_lossily() {
+        assert_eq!(from_bytes(&[0xC0, 0x80]), "��");
+    }
+}