fix(channel): bind NOTIFY payloads via pg_notify

[arimu1]

Summary

• Fix SQL injection in Channel.fromNameAndProtocol by sending notification payloads through bound parameters instead of embedding them in the SQL string.
• PostgreSQL rejects parameterized NOTIFY ... $1 syntax; use SELECT pg_notify($1, $2) IS NULL with both channel name and payload bound as text.
• Execute via executeSized so the extended query completes with Sync and notifications are delivered reliably to listeners on the same session.

Fixes #1339

Test plan

• Added ChannelTest case with a payload containing single quotes and a double quote; verified round-trip locally against Postgres 11 (docker) on port 15432.
• CI (testsJVM/testOnly tests.ChannelTest) with project docker compose Postgres.