SQL Injection risks in Postgres meta queries

[rdimaio]

Example problematic query:

rucio/lib/rucio/core/did_meta_plugins/postgres_meta.py

Line 85 in 834a7c0

statement = "SET search_path TO {};".format(db_schema)

From the psycopg2 docs (https://www.psycopg.org/docs/usage.html#the-problem-with-the-query-parameters):

Warning
Never, never, NEVER use Python string concatenation (+) or string parameters interpolation (%) to pass variables to a SQL query string. Not even at gunpoint.

Affected queries should be rewritten in the way proposed here https://stackoverflow.com/questions/45128902/psycopg2-and-sql-injection-security to prevent SQL injections.

[rdimaio]

Blocked by #6669