Inside PostHog: SSRF, ClickHouse SQL Escape and Default Postgres Creds to RCE