fix(datastore/mysql): prevent SQL injection in GetTargetByScope

[whywaita]

Summary

GetTargetByScope was the only query in this file built with fmt.Sprintf, embedding the scope value directly into the SQL string. Every other query (e.g. GetTarget) uses bind parameters (?); this one used raw string concatenation.

// Before
query := fmt.Sprintf(`SELECT ... FROM targets WHERE scope = "%s"`, scope)
if err := m.Conn.GetContext(ctx, &t, query); err != nil {

scope originates from webhook payloads (repository / organization names) and the target registration API, so it is user-controllable. A value containing a double quote could break out of the string literal and inject SQL.

Changes

• Switch GetTargetByScope to a ? placeholder, matching GetTarget.
• Add a regression test asserting that a scope containing SQL meta characters is treated as a literal value and returns datastore.ErrNotFound (neither matching a row nor producing a SQL error).

// After
query := `SELECT ... FROM targets WHERE scope = ?`
if err := m.Conn.GetContext(ctx, &t, query, scope); err != nil {

Testing

• go build ./... and go vet ./... pass.
• The added test compiles; the integration test itself runs in CI (it depends on dockertest / MySQL).