feat: semgrep rule for db.sql

.github/helper/semgrep_rules/frappe_correctness.yml

@@ -131,3 +131,10 @@ rules:
       key `$X` is uselessly assigned twice. This could be a potential bug.
   languages: [python]
   severity: ERROR
+
+- id: frappe-using-db.sql
+  pattern-regex: \.sql.*\(
+  message: |
+    The PR contains a SQL query that may be re-written with frappe.qb (https://frappeframework.com/docs/user/en/api/query-builder) or the Database API (https://frappeframework.com/docs/user/en/api/database)
+  languages: [python]
+  severity: ERROR