Add URL parameter substitution for iframe embedding

[ankitsejwal]

Description

When embedding pgweb in iframes, users need to pass tenant-specific parameters (like gsr_client, gsr_inst) that should be automatically substituted into SQL queries without prompting the user.

Current Behavior

• Queries with @parameter placeholders always prompt users for input
• No way to pre-populate parameters from URL query strings
• Makes iframe embedding less seamless for tenant-aware applications

Desired Behavior

• Extract URL parameters matching patterns like gsr_*, tenant_*, user_* from query string
• Automatically substitute @parameter placeholders with URL values
• Only prompt users if no matching URL parameters are available (backward compatibility)
• Secure parameter handling with SQL injection protection

Use Case

// React iframe with tenant parameters
<iframe
  src={`/sql/embed/?gsr_client=${clientId}&gsr_inst=${instanceId}`}
  title="Database Interface"
/>

Queries like:

SELECT * FROM intf_automation.hubs 
WHERE gsr_client = @gsr_client AND gsr_inst = @gsr_inst

Should automatically substitute without user prompts.

[molschimke2]

The overlay should only be visible on the query editor. at the moment, it also shows up on the other tabs (e.g., rows)

[molschimke2]

we should move the overlay content into the integrated help feature: https://github.com/flowbi/web-services/issues/9

until the embedded documentation is in place, please remove the overlay for better screenshots.

The variable values could be added to the embedded documentation by varialbe substitution.