Refuse PRAGMA cipher_migrate on a read-only main database - #631

A connection opened read-only through the URI parameters mode=ro or immutable=1 runs PRAGMA cipher_migrate to success and rewrites the database file. db->openFlags is recorded before the URI is parsed and never carries mode=ro, so the ATTACH of the -migrated file, the export and the rename onto the main file all go through. With SQLITE_OPEN_READONLY the migration fails only because that ATTACH cannot create the -migrated file, which returns SQLITE_CANTOPEN and leaves the connection in the deferred error state.

The main btree is read-only on all three routes, so the check reads it once the legacy format has been detected and before any file is created. It returns SQLITE_READONLY and exits through cleanup like the other checks that run before the database is touched, which leaves the file unchanged and the connection usable. A read-only connection on a database already in the current format still gets 0, since nothing needs to be written. For SQLITE_OPEN_READONLY the result changes from 14 to 8 on purpose, so every read-only route reports the same cause.