Harden DB-GPT service endpoints

[m1n9yu3]

Summary

This PR applies defensive hardening across several DB-GPT service endpoints and helpers:

• Tightens agent file download path handling and route protection.
• Restricts plugin hub updates to expected repository URLs.
• Replaces regex-heavy SQL comment stripping with a linear scanner.
• Adds route-level user dependencies to sensitive knowledge APIs.
• Simplifies PDF title matching to avoid pathological regex behavior.
• Enforces configured API keys consistently for Prompt APIs and v1 user dependencies.
• Parameterizes datasource configuration SQL and adds regression coverage.
• Scopes legacy resource file paths to conversation upload directories.
• Replaces v2 chat app stream regex parsing with linear JSON extraction.

Validation

• Added focused regression tests for authentication helper behavior.
• Added focused regression tests for datasource configuration DAO filtering and updates.
• Added focused regression tests for resource file path scoping.
• Added focused regression tests for v2 chat app stream parsing.
• Ran syntax checks for touched Python modules.
• Ran focused pytest coverage for the new and updated tests.

Notes

This public PR intentionally keeps the description high level. It does not include vulnerability reproduction details.