v0.6.0

Harden the wire client, migrations and code generation

Wire protocol: reject a DataRow, ParameterDescription or RowDescription with a
negative field count (0xffff read as int16) instead of panicking in make; treat
a truncated authentication message as an error rather than AuthenticationOk;
bound the SCRAM iteration count (a hostile server can no longer force unbounded
PBKDF2 work) and reject a server nonce that does not extend the client nonce.

Migrations: pin search_path to public and fully qualify the pgc_migrations
table, so a decoy table in another schema cannot shadow the migration history;
teach the statement splitter about E'...' escape strings so a backslash-escaped
quote with an embedded semicolon no longer splits a no-transaction migration.

Code generation: always derive a valid, compilable Go identifier (rune-safe
capitalization, non-identifier runes dropped, X prefix for a leading digit or
empty result); read a quoted identifier with a doubled quote whole when
inferring parameter names; and give two same-base import paths distinct
selectors with explicit aliases so the generated import block compiles.