[DSIP-89][Task] Render SQL parameters before statement execution

[qiuyanjun888]

Was this PR generated or assisted by AI?

YES. This pull request was assisted by Hermes Agent / OpenAI Codex for code changes, focused tests, documentation updates, and local verification. The scope and final submission were directed by the contributor.

Purpose of the pull request

Fix #17263.

Render SQL task custom parameters locally before submitting SQL through JDBC Statement, avoiding PreparedStatement for SQL text that already contains DolphinScheduler parameter syntax.

This pull request supersedes #18396, which was closed because the original description did not include the AI-assistance declaration required by the current pull request template.

Brief change log

• Add a SQL task local parameter renderer for ${name} and !{name} placeholders.
• Render normal ${name} placeholders as SQL literals by default, including escaping string-like values and validating typed literals.
• Preserve raw !{name} replacement for trusted SQL fragments without rescanning rendered replacement text.
• Use JDBC Statement to execute rendered SQL in SqlTask.
• Document SQL task parameter rendering rules and raw replacement constraints.
• Add regression coverage for identifier fragments, list values, quoted strings, raw fragments, malformed typed literals, and Statement execution.

Verify this pull request

This change added tests and can be verified as follows:

• ./mvnw -pl dolphinscheduler-task-plugin/dolphinscheduler-task-sql -am -DskipUT=false -DskipITs -DskipE2E -Dcheckstyle.skip -Dspotless.check.skip -Djacoco.skip=true -Dsurefire.failIfNoSpecifiedTests=false -Dtest=SqlTaskTest test
• ./mvnw -pl dolphinscheduler-task-plugin/dolphinscheduler-task-sql -am spotless:apply
• git diff --check

Pull Request Notice

Pull Request Notice