[fix] stop jdbc connection properties injected through the database name

[Duansg]

What's changed?

The JDBC URL blacklist added in #3250 only guards the url a user types in. When url is empty the collector falls back to concatenating host, port and database into the connection URL, and database is a free-form text parameter — no validator constrains it and JdbcProtocol.isInvalid() skips it. A value such as db allowLoadLocalInfile=true&autoDeserialize=true&z= therefore reaches the driver with exactly the properties the blacklist exists to reject, turning a monitor pointed at a hostile MySQL server into local file disclosure on the collector.

Checklist

• I have read the Contributing Guide
• I have written the necessary doc or comment.
• I have added the necessary unit tests and all cases have passed.

Add or update API

• I have added the necessary e2e tests and all cases have passed.