[DEV-15416] CSV header names interpolated into CREATE TABLE

[DavidMikolaKC]

Description:

When creating new population data tables using incoming treasury csv files, the default headers are passed directly into a create_table command without any processing. While unlikely, checks should be added to account for the possibility of receiving a compromised file.

Technical Details:

loaders.py:75 interpolates each CSV header c as f"{c} TEXT" into a CREATE TABLE statement and executes it with no identifier quoting or allow-list. A simple allow-list is added using the column mappings present in the loader factories

Requirements for PR Merge:

1. Unit & integration tests updated
2. API documentation updated (examples listed below)
   1. API Contracts
   2. API UI
   3. Comments
3. Data validation completed (examples listed below)
   1. Does this work well with the current frontend? Or is the frontend aware of a needed change?
   2. Is performance impacted in the changes (e.g., API, pipeline, downloads, etc.)?
   3. Is the expected data returned with the expected format?
4. Appropriate Operations ticket(s) created
5. Jira Ticket(s)
   1. DEV-15416

Explain N/A in above checklist:

[sethstoudenmier]

Shouldn't this check that the length of the approved_cols is equal to the length of the supplied columns? Otherwise, it will attempt to process if only a single column is approved.