Same treatment the RBAC plugin got: the host resolves writer and
read-replica URLs from its env and hands them to an installed SSO plugin
at create time, with separate connection limits for writes (default 2)
and reads (default 5). A plugin that owns its own database client can
route login-path reads to the read replica instead of holding them on
the primary. The database config type moves to a shared
PluginDatabaseConfig used by both plugin contracts.
Matt Aitken
f746b02873