fix: bind attach database path

[Gares95]

Summary

This updates Database.attach() to bind the attached database filepath as a SQL parameter instead of interpolating it into the ATTACH DATABASE statement.

What changed

• Bind the resolved filepath with ATTACH DATABASE ? AS ...
• Keep existing alias quoting behavior unchanged
• Add Python API coverage for attached database paths containing an apostrophe
• Add CLI --attach coverage for attached database paths containing an apostrophe

Why

Filepaths can contain apostrophes, and binding the path keeps attach() working for those valid paths without changing alias handling.

Tests

Focused Docker validation:

python -m pytest tests/test_attach.py tests/test_cli.py::test_attach tests/test_cli.py::test_attach_filepath_with_apostrophe -q

Result:

4 passed

Compatibility notes

This keeps path resolution and alias quoting behavior unchanged. The SQL text now uses a bound parameter for the filepath, which is consistent with parameterized SQLite execution.

---

📚 Documentation preview 📚: https://sqlite-utils--748.org.readthedocs.build/en/748/