Detect SQL injection patterns

Implement a heuristic SQL-injection detector for a web application firewall. Given a `query` string (raw user input), return True if it contains any of these suspicious patterns (case-insensitive): a tautology like ' OR '1'='1 (an apostrophe, optional whitespace, 'or', whitespace, optional apostrophe, '1', optional apostrophe, optional whitespace, '=', optional whitespace, optional apostrophe, '1'); a '; DROP TABLE' statement; a SQL comment '--'; or a 'UNION SELECT' clause (with whitespace between). Otherwise return False. This is a heuristic, not a parser.