[Nacl-HCl]

Does your PR solve an issue?

fixes #4491

Is this a breaking change?

No. SET NAMES 'charset' [COLLATE 'collation'] with quoted string literals is valid MySQL syntax with identical semantics to the unquoted form; the generated statement only differs in quoting.

---

charset, collation and time_zone come from the connection URL (or the builder methods) and were interpolated into the connect-time SET statement without quoting (charset/collation not quoted at all, time_zone wrapped in single quotes but not escaped). Since the connection enables CLIENT_MULTI_STATEMENTS, a crafted value like time_zone='; <arbitrary SQL>; -- could inject a second statement.

This quotes all three as MySQL string literals via a new quote_string_literal() helper (single quotes are doubled, backslashes escaped), and extracts statement building into MySqlConnectOptions::connect_init_statement() so it can be unit-tested without a live connection.

How verified:

• New regression tests fail on the old interpolation and pass with the fix (injection payloads for all three parameters are neutralized inside the literal).
• cargo test -p sqlx-mysql --lib options::: 12 passed, 0 failed.
• cargo fmt --check clean; cargo clippy --all-targets clean for the touched file.
• Integration tests requiring a live MySQL server were not run locally (no DB in this environment); statement-level correctness is covered by the unit tests.