Add keep strategy for conditional column passthrough (#77)

[ababic]

Summary

Implements #77: an explicit keep anonymization strategy so column_cases can leave selected cell values unchanged while a default [rules] entry still scrubs the same column for other rows (e.g. staff email allowlists).

Behavior

• strategy = "keep" leaves the original INSERT/COPY cell bytes unchanged (including SQL NULL / COPY \N)
• Allowed only under [column_cases] (rejected as a blanket [rules] default to avoid accidental no-ops)
• Rejects domain, as_string, and other strategy options (like other constant strategies)
• Counts as coverage for --strict-coverage / [sensitive_columns]
• Does not count as a cell change for --check / reports

Example

[rules."public.reskinned_inventory_user"]
email = { strategy = "email", domain = "wms_user_email", unique_within_domain = true }

[[column_cases."public.reskinned_inventory_user".email]]
when.any = [
  { column = "email", op = "ilike", value = "%@wearecrew.com" },
  { column = "email", op = "ilike", value = "%@reskinned.clothing" },
]
strategy = { strategy = "keep" }

Test plan

• Unit tests for keep preservation / no max-len truncation
• Config validation: reject under [rules], allow under column_cases, reject domain
• End-to-end INSERT + COPY with staff-domain ilike cases + strict-coverage assertion
• cargo fmt --check, cargo clippy --all-targets --all-features -- -D warnings, cargo test --all-targets --all-features (152 passed)
• CLI smoke: staff emails kept, others redacted, --strict-coverage clean; keep under [rules] rejected

Smoke output excerpt:

INSERT ... VALUES (1, 'REDACTED'), (2, 'bob@wearecrew.com'), (3, 'carol@reskinned.clothing');
COPY ...
4       REDACTED
5       erin@wearecrew.com
cells_changed=2 covered=['public.users.email'] uncovered=[]