pgsql: pg_createsubscriber: Obstruct SQL injection via subscription nam

pg_createsubscriber: Obstruct SQL injection via subscription names.

drop_existing_subscription() neglected to escape the subscription
name when generating its query string. To fix, use
PQescapeIdentifier() to construct a properly escaped name, and use
it in the ALTER SUBSCRIPTION and DROP SUBSCRIPTION commands.

Reported-by: Yu Kunpeng <yu443940816(at)live(dot)com>
Author: Nathan Bossart <nathandbossart(at)gmail(dot)com>
Reviewed-by: Amit Kapila <amit(dot)kapila16(at)gmail(dot)com>
Security: CVE-2026-6476
Backpatch-through: 17

Branch
------
REL_18_STABLE

Details
-------
https://git.postgresql.org/pg/commitdiff/c2e44c370edc003367e94bde137c6d9cfab5919c
Author: Nathan Bossart <nathan(at)postgresql(dot)org>

Modified Files
--------------
src/bin/pg_basebackup/pg_createsubscriber.c | 11 ++++++++---
1 file changed, 8 insertions(+), 3 deletions(-)