fix: Fix vulerability by using query parameters instead of string formatting

[dishaprakash]

Description

This PR addresses a SQL injection vulnerability in AsyncPostgresVectorStore and improves type safety across the vector store queries.

Previously, ref_doc_id delete operations and MetadataFilters used f-string interpolation to construct SQL queries, which allowed unescaped user-controlled values to be directly injected into the SQL statement. This PR migrates all raw string concatenations to use SQLAlchemy's secure parameter binding (:param).

Key Changes

• SQL Injection Fix: Refactored adelete, adelete_nodes, __query_columns, __parse_metadata_filters_recursively, and __parse_metadata_filter in async_vector_store.py to use bind_params.
• Array Operator Support: Updated parameterization logic for Postgres array operations (IN, NIN, ANY, ALL). The fix dynamically unpacks Python lists into individual scalar variables (e.g., :param_0_0, :param_0_1) and constructs a safe ARRAY[] wrapper, preventing asyncpg type serialization errors.

Impact

Prevents potential data exfiltration and unauthorized deletion (e.g., bypassing tenant isolation by injecting metadata parameters or dropping entire tables via ref_doc_id manipulation)